SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,687 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation of Microsoft Office macro-enabled files (docm, dotm, xlsm, xltm, potm, pptm) when the creating process or its parent process is a suspicious utility often abused by adversaries. The suspicious utilities include cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe. This behavior is indicative of potential initial access or execution techniques where malicious macros are delivered or generated.
Detects the presence of Silence EmpireDNSAgent by looking for specific PowerShell script block text patterns associated with both the Empire post-exploitation framework and Dnscat2 tunneling. The rule combines keywords related to system shutdown/reboot, process manipulation, and DNS tunneling techniques used by this malware.
This rule detects the execution of the `Get-ADReplAccount` cmdlet from the DSInternals PowerShell module with specific parameters (`-All` and `-Server`). This cmdlet is used to perform a DCSync attack, which allows an attacker to retrieve password hashes and other sensitive Active Directory information by simulating a domain controller replication. The DSInternals module provides advanced capabilities for Active Directory manipulation and auditing, and its use in this manner is highly suspicious and indicative of credential access attempts.
This rule detects PowerShell script blocks that attempt to register an XLL (Excel Add-in) file using COM objects. Adversaries may abuse Microsoft Office add-ins, specifically XLL files, to establish persistence on a compromised system. The detection looks for the combination of 'new-object', '-ComObject', '.application', and '.RegisterXLL' within a PowerShell script block, indicating an attempt to programmatically register an XLL add-in.
This rule detects PowerShell scripts attempting to use specific Windows API functions that are commonly associated with malicious activities such as process injection (VirtualAlloc, OpenProcess, WriteProcessMemory, CreateRemoteThread), token manipulation (OpenProcessToken, LookupPrivilegeValue, AdjustTokenPrivileges, DuplicateTokenEx), and memory operations (ReadProcessMemory, VirtualFree). Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
This rule detects the use of Gpg4win (gpg.exe or gpg2.exe) to encrypt or decrypt files. The detection specifically triggers when the command line includes the '-passphrase' argument and the file being operated on is located in suspicious directories such as 'PerfLogs', 'Temp', 'Users\Public', 'Windows\Temp', 'AppData\Local\Temp', or 'AppData\Roaming'. This behavior can indicate an adversary encrypting collected data before exfiltration or using these common staging areas for malicious operations.
This rule detects the execution of `netsh.exe` commands that modify the Windows Firewall to whitelist a program. Specifically, it looks for `netsh.exe` being executed with arguments to 'add allowedprogram' or 'add rule' with 'action=allow' and 'program=' where the program path is located in suspicious directories such as Recycle Bin, System Volume Information, Temp folders, or various Windows system subdirectories that are not typical locations for legitimate applications requiring firewall exceptions.
This rule detects the execution of 'plink.exe' with command-line arguments indicative of RDP tunneling. Specifically, it looks for 'plink.exe' combined with ':127.0.0.1:3389' or ':3389' along with '-P 443' or '-P 22'. This activity suggests an adversary is using Plink to establish a tunnel, potentially to exfiltrate data or maintain covert access to a remote desktop session.
Detects suspicious modifications to BitLocker-related registry keys using the `reg.exe` utility. Adversaries may modify these keys to enable or disable BitLocker, potentially as a precursor to data encryption for impact (ransomware) or to facilitate data exfiltration by disabling encryption.
Detects the use of the 'reg.exe' utility to disable Protected Process Light (PPL) protection for the Local Security Authority (LSA) process. This modification can allow attackers to dump LSA secrets, which contain credential material.
Page 468 of 680