SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,700 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects instances where the 'winlogon.exe' process initiates outbound network connections to public IP addresses. Winlogon.exe is a critical Windows component responsible for user logon/logoff and the secure attention sequence. Typically, winlogon.exe should not be making outbound network connections to public IPs. Such activity could indicate compromise, potentially by malware like BlackLotus, which has been observed to leverage winlogon.exe for malicious purposes, including command and control or data exfiltration.
This rule detects PowerShell script blocks that attempt to execute batch scripts (.cmd or .bat files) using 'Start-Process'. This behavior can be indicative of an adversary abusing the Windows command shell for execution, potentially to run a series of commands or a malicious payload.
Detects PowerShell activity where the 'Get-AdDefaultDomainPasswordPolicy' cmdlet is used to retrieve the default password policy for an Active Directory domain. This action can be performed by adversaries to understand password complexity requirements and account lockout policies, which can aid in planning brute-force or password-guessing attacks.
Detects the execution of 'curl.exe' with command-line flags that disable security checks for proxy or DNS over HTTPS (DoH) connections. This behavior can indicate an attempt to bypass security controls or establish covert communication channels.
Detects the execution of the "driverquery" utility, which can be used by adversaries to perform reconnaissance on installed drivers. This rule specifically looks for 'driverquery.exe' or 'drvqry.exe' as the image or original filename.
This rule detects the execution of the 'netsh.exe' utility specifically when it is used to modify existing Windows Advanced Firewall rules. The detection logic looks for 'netsh.exe' being executed with the 'advfirewall' and 'set' options in the command line, indicating an attempt to change properties of an already defined firewall rule. This activity could be indicative of an adversary attempting to bypass network controls to facilitate C2 communications, lateral movement, or data exfiltration.
This rule detects the execution of the 'rar.exe' utility with command-line arguments indicating the creation of an archive that is either password-protected ('-hp') or uses a specific compression level ('-m'). This combination of parameters is often associated with malicious activities, such as data exfiltration or staging, where adversaries compress and password-protect data before moving it off a compromised system.
Detects suspicious execution of rundll32.exe with specific DLLs and functions that are known to be abused for defense evasion and arbitrary code execution, often referred to as Living Off The Land Binaries (LOLBINs). The rule identifies various combinations of DLLs (e.g., url.dll, zipfldr.dll, shell32.dll, mshtml.dll, advpack.dll, ieadvpack.dll, ieframe.dll, shdocvw.dll, syssetup.dll, setupapi.dll, pcwutl.dll, dfshim.dll, scrobj.dll, shimgvw.dll, comsvcs.dll) and their associated functions that can be used to execute scripts, open URLs, or perform other actions in an unexpected manner via rundll32.exe. It includes filters to reduce false positives from legitimate system activities like screensaver or control panel operations.
Detects the execution of the 'wpbbin.exe' binary located in 'C:\Windows\System32\'. This binary is associated with a UEFI-based persistence method, as described in the provided references, which allows for the injection of executable files into BitLocker-protected drives.
Detects exploitation attempts targeting the F5 BIG-IP vulnerability CVE-2020-5902. The rule looks for specific URI query patterns indicative of directory traversal within the '/tmui/' or '/hsqldb' paths, which are known to be vulnerable.
Page 455 of 680