SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,696 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation of files with names commonly associated with credential dumping tools or the output files generated by such tools. This includes executables of known credential dumpers like fgdump, pwdump, cachedump, procdump, and Windows Credential Editor (WCE), as well as output files like 'fgdump-log', 'kirbi', 'pwdump', 'pwhashes', 'wce_ccache', 'wce_krbtkts', 'NTDS.out', 'SAM.out', 'SECURITY.out', and 'SYSTEM.out'.
This rule detects the creation of executable files with suspicious names or extensions. Specifically, it looks for files ending with '.exe' that are appended to common system directory names (e.g., ':\$Recycle.Bin.exe', ':\MSOCache.exe') or other executable extensions (e.g., '.bat.exe', '.sys.exe'). This pattern is often used in unquoted service path vulnerabilities or to masquerade malicious executables as legitimate system files.
This rule detects the creation of specific files that indicate interactive PowerShell usage within the SYSTEM user context. The rule looks for the creation of 'ConsoleHost_history.txt' or 'StartupProfileData-Interactive' files in the 'C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\' or 'C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\' directories respectively. The presence of these files in the SYSTEM profile suggests that PowerShell was used interactively by the SYSTEM account, which is highly unusual and could indicate privilege escalation or malicious activity.
This rule detects the use of the PowerShell cmdlet 'Mount-DiskImage' with the '-ImagePath' parameter. Adversaries may use this technique to mount disk image files (like ISO or VHD) containing malicious payloads. This method can bypass Mark-of-the-Web (MOTW) controls, as files extracted or accessed from a mounted image may not inherit the MOTW, allowing them to execute without typical security warnings or protections.
Detects modifications to Windows Defender configuration settings using PowerShell to add exclusions. This activity is often performed by adversaries to disable or bypass security controls, allowing their malicious activities to go undetected.
Detects suspicious child processes spawned by "BgInfo.exe" or "BgInfo64.exe". This behavior can indicate an attempt to abuse BgInfo, a legitimate Microsoft utility, for proxy execution of other binaries or scripts, often to bypass application whitelisting or other security controls. The rule specifically looks for common command-line interpreters (cmd.exe, powershell.exe, cscript.exe, wscript.exe), other executables (calc.exe, notepad.exe, mshta.exe), or executables launched from suspicious user-writable directories (AppData, Users\Public, Temp, PerfLogs).
Finger.EXE Execution
Sigma
Detects the execution of the "finger.exe" utility, which is an old Windows utility used to display information about users on a remote computer running the finger service. Due to its age and the rarity of the finger service being active, any execution of this utility is considered suspicious and warrants investigation.
This rule detects the execution of `ruby.exe` with command-line arguments indicative of Evil-WinRM usage. Specifically, it looks for the presence of `-i`, `-u`, and `-p` flags, which are commonly used by Evil-WinRM for specifying the target IP address, username, and password for Windows Remote Management (WinRM) access. This activity suggests an adversary is attempting to establish remote control over a system using a known penetration testing tool.
Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts.
Detects attempts to downgrade PowerShell to version 2.0 by checking for specific command-line arguments. This technique is often used by adversaries to bypass security features like Script Block Logging and AMSI, which are present in newer versions of PowerShell.
Page 460 of 680