SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,706 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects instances where Sysmon's FileBlockShredding event (EventID 28) is triggered. This event indicates that a file shredding operation was attempted but blocked due to a configured policy violation. This could be an attempt by an adversary to destroy evidence or render data unrecoverable.
This rule detects suspicious scripting commands within WMI event consumers, which can be indicative of persistence mechanisms. Specifically, it looks for PowerShell web download commands (`new-object net.webclient .downloadstring`, `new-object net.webclient .downloadfile`), common PowerShell execution flags (`-nop`, `-noprofile`, `-decode`, `-enc`), and references to `WScript.Shell` or `System.Security.Cryptography.FromBase64Transform` within the 'Destination' field of WMI event logs. These patterns are frequently used by attackers to execute malicious scripts or download payloads via WMI persistence.
This rule detects instances where specific system binaries (msdtc.exe or gpsvc.exe) are executed from non-standard Windows system directories. This behavior is often indicative of masquerading, where malicious executables are named after legitimate system processes to evade detection, a tactic known to be used by the Lazarus Group.
Detects the creation of suspicious printer ports that point to executable files or use the 'Generic / Text Only' driver, which can be abused for persistence or execution, often associated with CVE-2020-1048 (PrintDemon).
Detects exploitation of the DNS RCE vulnerability (CVE-2020-1350) by monitoring for suspicious sub-processes spawned by the `dns.exe` service. This rule specifically looks for processes created by `dns.exe` that are not common or expected system processes, indicating potential post-exploitation activity after successful exploitation of the vulnerability.
This rule detects specific file paths, command-line arguments, and PowerShell commands associated with the Greenbug espionage group's May 2020 campaign, as reported by Symantec. It looks for suspicious executables in ProgramData directories, the use of 'revshell.exe' and 'ncat.exe' (especially with '-e cmd.exe'), and various PowerShell command patterns indicative of malicious activity, including base64 encoded strings.
Detects possible successful exploitation of CVE-2021-26858 (ProxyLogon) by monitoring for the creation of non-standard files by the Exchange Server's Unified Messaging service (UMWorkerProcess.exe). This activity could indicate the dropping of web shells or other malicious content post-exploitation.
This rule detects the creation or modification of a registry run key that exhibits characteristics associated with the 'Small Sieve' malware. Specifically, it looks for a registry path containing '\Microsoft\Windows\CurrentVersion\Run\' combined with either the intentional typo 'Microsift' in the TargetObject or the string '.exe Platypus' in the Details field. These indicators are known to be used by the Small Sieve malware for persistence.
Detects access patterns indicative of the DEWMODE webshell, which was used in attacks exploiting Accellion FTA. The rule looks for specific query parameters ('?dwn=', '&fn=', '.html?' or '&dwn=', '?fn=', '.html?') within the URI query string, which are characteristic of how this webshell operates.
Detects the execution of rundll32.exe with a command line that specifically loads a DLL named "1.dll" and calls the "DllRegisterServer" export function. This pattern has been observed in malware campaigns, particularly those involving IcedID.
Page 450 of 680