SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,712 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects when a file is restored from quarantine by Microsoft Defender Antivirus. This action is logged with Event ID 1009 in the Microsoft-Windows-Windows Defender/Operational event log. While legitimate administrators might restore files, this event can also indicate an adversary attempting to reintroduce malicious files that were previously quarantined, potentially as part of a defense evasion strategy.
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non-browser process. This behavior can indicate reconnaissance activity by malware or an attacker attempting to determine the external IP address of a compromised system.
This rule detects specific code artifacts commonly found in offensive PowerShell payloads such as Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, and PowerSploit. These artifacts often remain unchanged due to poor operational security practices by attackers. The rule looks for specific strings like '$DoIt', 'harmj0y', 'mattifestation', '_RastaMouse', 'tifkin_', and '0xdeadbeef' within PowerShell script payloads.
This rule detects suspicious PowerShell invocations by looking for specific command parameters that indicate obfuscation, hidden execution, or non-interactive sessions. Specifically, it flags the use of encoded commands (`-enc`, `-EncodedCommand`, `-ec`), hidden window styles (`-w hidden`, `-window hidden`, `-windowstyle hidden`, `-w 1`), and non-interactive flags (`-noni`, `-noninteractive`). These parameters are commonly used by adversaries to conceal their activities and bypass detection.
Detects the execution of the Windows Problem Steps Recorder (psr.exe) with command-line arguments indicating a recording start. Psr.exe is a legitimate utility that can be abused by adversaries to capture screen activity, which is a form of information collection.
Detects the execution of '3proxy.exe', a tiny free proxy server, based on its image name, description, or specific command-line parameters. This tool can be used by adversaries for command and control activities, specifically for proxying network traffic.
Detects the execution of Nmap or Zenmap, which are network scanning tools. Adversaries commonly use these tools for network service discovery to identify open ports and services on remote hosts, potentially looking for vulnerabilities to exploit.
Detects a potentially suspicious execution where a parent process located in the "\Users\Public" folder executes a child process that is a common shell or scripting binary, indicated by its image name or command line arguments. This behavior is often associated with malware attempting to hide in a publicly accessible directory and then execute further malicious commands.
This rule detects the creation of potentially suspicious child processes by WinRAR.exe. Adversaries may exploit vulnerabilities in WinRAR, such as CVE-2023-38831, to achieve arbitrary code execution. This rule specifically looks for WinRAR.exe spawning common scripting or execution binaries like cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, and wscript.exe. Such activity is highly indicative of an adversary attempting to execute further commands or payloads after exploiting WinRAR.
Detects suspicious processes, including various shells and utilities, spawned by the WinRM host process (wsmprovhost.exe). This activity can indicate an adversary using WinRM for remote execution, potentially for initial access, persistence, or privilege escalation.
Page 443 of 680