SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,717 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of new Outlook form files, which can be used by adversaries to establish persistence by embedding malicious code. The rule specifically looks for file creation events by 'outlook.exe' in known Outlook forms directories.
Detects suspicious activity where the MSExchangeMailboxReplication process writes .asp or .aspx files to disk. This behavior is often indicative of web shell deployment, potentially following an exploit like ProxyShell, to establish persistence or further access.
Detects instances where the svchost.exe process, specifically hosting the RDP terminal services, initiates outbound network connections to target systems on standard HTTP (TCP port 80) or HTTPS (TCP port 443) ports. This behavior is indicative of RDP tunneling, where RDP traffic is encapsulated within web protocols to bypass network restrictions or evade detection.
This rule detects attempts to delete Volume Shadow Copies using PowerShell and WMI. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially in ransomware attacks. The rule specifically looks for PowerShell commands that interact with 'Win32_ShadowCopy' via 'Get-WmiObject' and then perform a 'Delete()' operation or use 'Remove-WmiObject'.
Detects the execution of Certify, a tool used for Active Directory certificate abuse, by identifying its executable name, original file name, description in PE metadata, and specific command-line arguments related to certificate operations such as listing Certificate Authorities (CAs), finding vulnerable templates, requesting, and downloading certificates.
Detects the execution of the KrbRelay tool, a utility used for Kerberos relaying attacks. The rule identifies the tool by its executable name ('KrbRelay.exe') or its original filename, and by specific command-line arguments commonly used by KrbRelay for Kerberos relaying, including parameters related to Service Principal Names (SPN), Class IDs (CLSID), and Resource-Based Constrained Delegation (RBCD) or shadow credentials.
Detects the use of PowerShell cmdlets 'Add-MpPreference' or 'Set-MpPreference' in conjunction with parameters like '-ExclusionPath', '-ExclusionExtension', '-ExclusionProcess', or '-ExclusionIpAddress' to configure exclusions for Microsoft Defender Antivirus. This activity is often associated with defense evasion tactics used by adversaries to prevent security software from detecting their malicious activities.
Detects the use of 'reg.exe' to add or copy registry keys within the 'SafeBoot' path. This activity is often associated with ransomware attempting to ensure persistence or functionality in Windows Safe Mode, potentially to bypass security products that do not operate in that mode.
This rule detects attempts to query the 'MachineGuid' from the Windows Registry using the 'reg.exe' utility. The MachineGuid is a unique identifier for a Windows machine and its discovery can be an early step in an adversary's reconnaissance phase to identify the system they have compromised.
Detects the creation of suspicious child processes by 'scrcons.exe' (Script Event Consumer). 'scrcons.exe' is a legitimate Windows component used for WMI event handling, but its spawning of common scripting interpreters, proxy execution binaries, or task schedulers can indicate malicious activity, often related to persistence or execution techniques leveraging WMI.
Page 439 of 680