SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,676 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects when the Windows Defender operational event log is disabled by setting its 'Enabled' registry value to 0. This activity has been observed in relation to Lockbit 3.0 ransomware infections as a defense evasion technique.
This rule detects modifications to registry keys that enable the Dynamic Data Exchange (DDE) protocol in Microsoft Word or Excel. Specifically, it looks for changes to 'AllowDDE' in Word or 'DisableDDEServerLaunch'/'DisableDDEServerLookup' in Excel to a value that enables DDE. Adversaries may enable DDE to execute arbitrary commands, often as part of phishing campaigns or through embedded files, to bypass macro-based defenses.
This rule detects the execution of ZxShell malware by monitoring process creation events. Specifically, it looks for 'rundll32.exe' being executed with command-line arguments containing either 'zxFunction' or 'RemoteDiskXXXXX'. These strings are known indicators of ZxShell's operational behavior when launched via rundll32.
Detects activity associated with the Tropic Trooper campaign from November 2018, specifically looking for a distinct command-line string used by the threat actor. This rule targets a specific pattern in process command lines that indicates the execution of malicious code or scripts by Tropic Trooper, an actor known for targeting organizations in the energy and food and beverage sectors in Asia.
Detects the execution of a process with command-line arguments containing '-export dll_u' or ending with ',dll_u' or ' dll_u'. This specific export function name 'dll_u' is known to be used by tools associated with the Equation Group, indicating potential malicious activity related to their implants or frameworks.
Detects exploitation attempts of the Microsoft Exchange vulnerability CVE-2020-0688. This vulnerability allows for remote code execution due to improper validation of cmdlet arguments. The rule specifically looks for GET requests to '/ecp/' or '/owa/' paths containing '__VIEWSTATE=' in the query string, which is indicative of the exploitation attempt.
Detects attempts to exploit CVE-2020-10148, an authentication bypass vulnerability in SolarWinds Orion API. This rule looks for specific URI query patterns associated with the exploit, while excluding legitimate requests.
Detects the deployment of "Golden Chickens" malware, a method used by the Evilnum APT group. This rule specifically looks for the execution of 'regsvr32.exe' with specific command-line arguments that indicate the registration of an OCX file located in the user's AppData\Roaming directory. This technique is often used for defense evasion and persistence.
Detects specific command-line arguments used by the Conti ransomware during its execution phase. The rule looks for a combination of arguments including '-m ', '-net ', '-size ', '-nomutex ', and '-p \\', which are characteristic of Conti's encryption process. This pattern indicates the ransomware is likely attempting to encrypt files on the system or network shares.
Detects the creation of a Windows service named 'GoogleUpdate' with a specific ImagePath containing 'rundll32', 'FileProtocolHandler', and '\ProgramData\GoogleUpdate\GoogleUpdate.exe'. This pattern is associated with the Goofy Guineapig backdoor for persistence.
Page 478 of 680