SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,678 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of MSTSC (Microsoft Terminal Services Client) with specific command-line arguments ('noconsentprompt' and 'shadow:') which indicates an attempt to perform RDP session shadowing without user consent. This technique can be used for RDP session hijacking.
This rule detects the execution of PowerShell scripts where the script path explicitly includes or references the "C:\Users\Public" directory. This directory is often used by adversaries to store and execute malicious scripts due to its default write permissions for all users, making it a common location for staging and executing payloads.
Detects modifications to Group Policy settings using `reg.exe` by looking for specific registry paths and keys commonly associated with Group Policy configurations. Malicious GPO modifications can be used to implement various other malicious behaviors, including privilege escalation and defense evasion.
This rule detects an unusual process creation event where 'rundll32.exe' spawns 'explorer.exe' as a child process. This behavior is uncommon and has been observed in malware such as Gamarue, which uses this method to launch 'explorer.exe' in an atypical manner. The rule specifically filters out legitimate instances where 'rundll32.exe' might launch 'explorer.exe' via 'shell32.dll,Control_RunDLL', aiming to reduce false positives.
Detects 'svchost.exe' spawning 'rundll32.exe' with command arguments indicating the use of 'davclnt.dll,DavSetCookie' and a remote IP address. This activity is suspicious as it can be an indicator of data exfiltration, execution of code hosted on a WebDAV server, or exploitation related to CVE-2023-23397, particularly for NTLM hash theft.
Detects the execution of 'setspn.exe' with the query flag ('-q' or '/q'), which is commonly used by attackers to enumerate Service Principal Names (SPNs) as a precursor to Kerberoasting attacks. This activity can help identify potential attempts to discover service accounts with weak passwords that can be cracked offline.
Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
This rule detects attempts to uninstall the Crowdstrike Falcon sensor by monitoring process creation events for specific command-line arguments. It looks for the execution of 'WindowsSensor.exe' with the '/uninstall' and '/quiet' flags, which are indicative of a silent uninstallation process. Adversaries often disable security tools like EDRs to evade detection of their malicious activities.
Detects the creation of a PowerShell process (powershell.exe or pwsh.exe) as a child of WmiPrvSE.exe. This activity is indicative of potential lateral movement or execution via Windows Management Instrumentation (WMI), where WMI is used to spawn a PowerShell process on a system.
Detects the modification of the 'Debugger' value within the Image File Execution Options (IFEO) registry key for various Windows accessibility tools. This technique is commonly used by adversaries to establish persistence and privilege escalation by replacing legitimate accessibility tools (like sethc.exe or utilman.exe) with a malicious executable that launches with SYSTEM privileges from the login screen.
Page 477 of 680