SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,654 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects PowerShell scripts that query WMI for service information, specifically looking for the 'Win32_Service' class and requesting 'Name', 'DisplayName', 'PathName', and 'StartMode' properties. This activity is often associated with reconnaissance for unquoted service path vulnerabilities, a common technique used by penetration testers and attackers for privilege escalation.
Detects potentially suspicious execution of 'csc.exe' (C# compiler) when spawned by common applications like Office programs, scripting engines (cscript.exe, wscript.exe, mshta.exe, powershell.exe), or from suspicious file system locations. This behavior can indicate payload delivery, compilation of malicious code on the fly, or defense evasion techniques.
This rule detects the use of `find.exe` or `findstr.exe` to search for the string 'cpassword' within XML files located in the SYSVOL share. This activity is indicative of an adversary attempting to locate encrypted Group Policy Preferences (GPP) passwords, which can then be decrypted to obtain credentials.
Detects specific command-line patterns associated with Empire PowerShell UAC bypass methods. These patterns involve PowerShell commands designed to retrieve and execute content from the 'Update' registry key within 'HKCU:Software\Microsoft\Windows Update', which is a known technique used by Empire for privilege escalation.
This rule detects the execution of the Hashcat password cracking tool. It specifically looks for the `hashcat.exe` executable and command-line arguments indicative of cracking NTLM hashes (`-m 1000`) and using a rule file (`-r `). The rule aims to identify attempts to crack passwords, potentially using SAM file contents obtained from a Windows registry.
Detects the execution of the PurpleSharp adversary simulation tool by looking for specific image paths, original filenames, or command-line arguments associated with the tool. This rule helps identify when an adversary simulation or red team exercise involving PurpleSharp is being conducted on a system.
Detects the execution of the Windows LOLBIN (Living Off The Land Binary) PrintBrm.exe when it is used to create or extract ZIP files. This activity is generally not expected on a normal workstation and can indicate malicious use for data staging or exfiltration.
This rule detects the execution of arbitrary PowerShell code using SyncAppvPublishingServer.exe. Adversaries may abuse this legitimate Windows binary to proxy execution of malicious PowerShell commands, often as a method of defense evasion and to bypass PowerShell execution restrictions. The detection specifically looks for the execution of 'SyncAppvPublishingServer.exe' or 'syncappvpublishingserver.exe' with a command line containing '"n; ' which is a known pattern for invoking PowerShell via this binary.
Detects suspicious child processes spawned by Microsoft OneNote. This rule identifies attempts to execute malicious embedded objects from a .one file by monitoring for OneNote spawning known LOLBINs (Living Off the Land Binaries) or executables from suspicious paths. This behavior is often associated with initial access and execution techniques used by adversaries.
Detects PowerShell scripts attempting to modify Access Control Lists (ACLs) on files or directories within the Windows system folders. This activity can be indicative of an adversary trying to elevate privileges, establish persistence, or evade defenses by modifying critical system file permissions.
Page 497 of 680