SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,696 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of a file named "WerFault.exe" in the WinSxS directory by a non-system process. This activity is indicative of potential SNAKE malware persistence, as documented by the NSA and CISA. The rule specifically looks for file creations where the target filename starts with 'C:\Windows\WinSxS\' and ends with '\WerFault.exe', while excluding processes originating from standard Windows system directories to reduce false positives.
Detects the creation of specific executable files, 'jpsetup.exe' or 'jpinst.exe', which have been identified by CISA as indicators of SNAKE malware installation. The rule specifically looks for these filenames in the 'Image' field (process executable path) and excludes cases where the 'CommandLine' is empty or null, or explicitly matches the executable name, to reduce false positives.
Detects potential beaconing activity to domains associated with the 3CXDesktopApp supply chain compromise. This rule specifically looks for DNS queries to known malicious domains identified during the compromise.
Detects potential malicious .ICO files downloaded from a compromised 3CXDesktopApp via web requests to a malicious GitHub repository, indicative of the SmoothOperator campaign.
This rule detects the creation of PowerShell script files with specific filenames or suffixes that have been observed in campaigns attributed to the FIN7 threat group. Specifically, it looks for files ending with '_64refl.ps1' or named 'host_ip.ps1'. These patterns are indicative of PowerShell scripts used by FIN7 for various malicious activities, including execution and potentially reflective loading.
Detects logon events (Event ID 4672 and 4964) involving accounts with special privileges or belonging to special groups, such as administrators. The rule filters out the local system account (S-1-5-18) and allows for a configurable filter for valid internal accounts to reduce false positives.
Detects the loading of `dbghelp.dll` or `dbgcore.dll` by processes that are typically not expected to load these DLLs. These DLLs export functions like `MiniDumpWriteDump` which can be used to dump process memory, including sensitive information like credentials from processes such as LSASS. This behavior is often observed in attacker tradecraft, such as with the SilentTrinity C2 Framework, or by legitimate debugging tools like ProcessHacker. The rule includes filters for common legitimate Windows processes and services that might load these DLLs to reduce false positives. Investigation of the command line and image location of the process loading the DLL is recommended.
Detects a PowerShell process attempting to access the Local Security Authority Subsystem Service (LSASS) process memory. This activity is a strong indicator of potential credential dumping attempts, where an attacker tries to extract sensitive authentication material (like passwords or hashes) from memory.
This rule detects the execution of PowerShell scripts that directly call a wide range of Windows API (WinAPI) functions. Adversaries often leverage direct WinAPI calls from PowerShell to bypass typical detection mechanisms that focus on standard PowerShell cmdlets or .NET methods. The rule specifically looks for a comprehensive list of sensitive WinAPI functions within the script block text, which can indicate various malicious activities such as process injection, privilege escalation, credential access, and memory manipulation. This rule is primarily intended for threat hunting to identify unusual and potentially malicious PowerShell script behavior.
Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc. This can be used by malicious actors to create malicious Office documents with macros on the fly.
Page 463 of 680