SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,667 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation of a named pipe using `cmd.exe` or `powershell.exe` by looking for specific command-line arguments. The presence of `echo`, `>` and `\\.\pipe\` in the command line indicates an attempt to create or interact with a named pipe. This activity can be associated with privilege escalation techniques, where an attacker might use named pipes for inter-process communication to elevate privileges.
This rule detects the creation of the PSEXESVC.exe process, which is the service component of PsExec. The presence and execution of this service indicate that PsExec was used to remotely execute commands or applications on the system.
This rule detects the execution of a child process by the PSEXESVC.exe service, specifically when that child process runs with LOCAL_SYSTEM privileges. This indicates that a command was remotely initiated on the system with the highest possible privileges, rather than the privileges of the initiating user account. This behavior is characteristic of PsExec being used for remote execution with SYSTEM-level access.
Detects the creation of new processes using the 'wmic.exe' utility with the 'process call create' command-line arguments. This is a common technique used by adversaries for execution.
This rule detects suspicious execution of WMIC (Windows Management Instrumentation Command-line) by Microsoft Office applications. Adversaries often leverage Office applications as an initial execution vector and then use LOLBINs (Living Off the Land Binaries) like WMIC to proxy execution, break parent-child process chains, and evade detection. Specifically, this rule looks for Office processes (Word, Excel, PowerPoint, etc.) spawning `wmic.exe` with command-line arguments indicative of process creation and execution of other suspicious LOLBINs such as `regsvr32`, `rundll32`, `msiexec`, `mshta`, `verclsid`, `wscript`, or `cscript`.
Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", "bitsadmin", "certutil", "cscript", "wscript", "mshta", or commands involving 'cmd.exe' or 'powershell', or paths like 'Users\Public', 'Windows\Temp', 'AppData\Local', and common temporary/program data environment variables. This indicates potential malicious execution or persistence.
Detects tampering of RDP Terminal Service/Server sensitive settings by monitoring changes to specific registry keys. This includes scenarios such as enabling RDP connections, allowing multiple RDP sessions per user, or disabling Network-Level Authentication (NLA) by setting the relevant registry values to '0'. Such modifications can facilitate unauthorized access or RDP hijacking.
Detects tampering of RDP Terminal Service/Server sensitive settings. This includes modifications to allow unsolicited remote assistance, disable security settings, or enable RDP via specific registry keys. It also covers changes related to RDP hijacking via the 'ServiceDll' key and the 'Shadow' RDP technique.
This rule detects the creation of any Portable Executable (PE) file that is monitored by the Sysmon configuration. It specifically triggers on Sysmon Event ID 29, which corresponds to 'FileExecutableDetected'. This event indicates that Sysmon has identified and logged the creation of an executable file based on its internal configuration.
Detects Microsoft Word (WINWORD.EXE) starting the uncommon sub-process FLTLDR.exe, which is indicative of exploitation attempts for vulnerabilities like CVE-2017-0261 and CVE-2017-0262. This behavior suggests a malicious document is attempting to execute arbitrary code.
Page 488 of 680