SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,676 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of SyncAppvPublishingServer.exe, which can be abused by adversaries to bypass PowerShell execution restrictions. This rule specifically looks for the string 'SyncAppvPublishingServer.exe' within the 'ContextInfo' field of PowerShell module logs, indicating its use in a PowerShell context.
This rule detects suspicious PowerShell activity involving the mounting of a disk image (like ISO or VHD) and then immediately invoking an item from that mounted image. This technique is often used by adversaries to bypass Mark-of-the-Web (MOTW) protections, as files extracted or run from mounted disk images may not inherit the MOTW flag, allowing malicious payloads to execute without security warnings.
Detects suspicious PowerShell invocation command parameters such as encoded commands, hidden window styles, and non-interactive modes. These parameters are frequently used by adversaries to obfuscate malicious scripts, execute them stealthily, or prevent user interaction.
Detects access to the LSASS process by a Python-based tool, indicated by specific call trace patterns involving Python DLLs and KERNELBASE.dll/ntdll.dll, combined with a broad granted access right (0x1FFFFF). This activity is characteristic of credential dumping tools like LaZagne or Pypykatz.
Detects the execution of 7-Zip (7z.exe, 7za.exe, 7zr.exe) to compress files with extensions like '.dmp', '.dump', or '.hdmp'. This activity is often a precursor to data exfiltration, where memory dump files or other sensitive data are compressed for easier transfer.
Detects the use of bitsadmin.exe to download files with suspicious extensions. This technique is often used by adversaries for defense evasion and persistence by leveraging a legitimate Windows utility to transfer malicious payloads.
Detects the use of the built-in Windows utility bitsadmin.exe to download files. This utility is often abused by adversaries for ingress tool transfer, as it can bypass certain network restrictions and is a living-off-the-land binary (LOLBIN). The rule specifically looks for the execution of bitsadmin.exe with command-line arguments indicative of file transfer operations, such as '/transfer', '/create', '/addfile', and the presence of 'http' to signify a URL download.
Detects the execution of "DirLister.exe", a utility used by the BlackCat ransomware group to enumerate files and directories on a compromised system. This tool helps adversaries quickly map out the file system for further malicious activities like data exfiltration or encryption.
This rule detects the execution of 'git.exe' or 'git-remote-https.exe' when attempting to clone a remote repository. The detection is specifically triggered if the command line arguments contain keywords commonly associated with exploits, vulnerabilities, or proof-of-concept code, such as 'exploit', 'Vulns', 'vulnerability', 'RemoteCodeExecution', 'Invoke-', 'CVE-', 'poc-', 'ProofOfConcept', 'proxyshell', 'log4shell', 'eternalblue', 'eternal-blue', or 'MS17-'. This aims to identify reconnaissance activities where adversaries might be searching for or downloading publicly available exploit code.
Detects the creation of a scheduled task using common command-line patterns associated with PowerSploit or Empire's default configurations. This rule specifically looks for `schtasks.exe` being executed by PowerShell with parameters indicative of task creation, including specific task names like 'Updater' and common scheduling triggers.
Page 476 of 680