SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,654 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects PowerShell command-line obfuscation techniques, specifically those associated with Invoke-Obfuscation, by looking for patterns like backticks, string concatenation, and format string abuse in process command lines. It also includes a specific pattern for obfuscated environment variable access.
Detects the execution of Sysinternals Sdelete when its executable file has been renamed from its original name (sdelete.exe or sdelete64.exe). This behavior is often indicative of an attempt to evade detection or obscure the use of a legitimate tool for malicious purposes, such as data destruction.
Detects the creation of suspicious processes (like command interpreters or scripting engines) as child processes of the Serv-U.exe application. This pattern is indicative of potential exploitation of the Serv-U service, possibly through vulnerabilities like CVE-2021-35211, leading to arbitrary command execution.
This rule detects the execution of commands or processes that contain specific command-line arguments or strings commonly associated with cryptocurrency mining activities. It looks for parameters such as CPU priority settings, donation levels (often set to zero by malicious miners), pool server addresses (e.g., 'pool.', 'stratum+tcp://', 'stratum+udp://'), and specific mining algorithms like 'rx/0'. The rule also includes base64 encoded versions of some of these strings to evade simple detection. It filters out common false positives like 'pool.c', 'pool.o', and 'gcc -' which might appear in legitimate compilation processes.
This rule detects the execution of specific Windows utilities (`tree.com`, `WMIC.exe`, `doskey.exe`, `sc.exe`) when their output is redirected to a temporary file. This behavior is often associated with adversaries collecting system information or reconnaissance data for later exfiltration or analysis, as indicated by the use of `> %TEMP%\` or `> %TMP%\` in the command line.
This rule detects the use of weak or commonly abused passwords directly within command-line interfaces. Threat actors often use this method to create new user accounts with easily guessable or known compromised passwords. The rule specifically looks for a predefined list of weak passwords appearing in the command line of a process creation event.
This rule detects the highly unusual activity of 'svchost.exe' being spawned without any command-line arguments. This behavior is often indicative of a malicious process injecting code into the 'svchost.exe' memory space, leveraging a legitimate system process to evade detection. The rule specifically filters out known legitimate instances where 'svchost.exe' might appear without arguments, such as when spawned by 'rpcnet.exe' or 'rpcnetp.exe'.
Detects the addition of new root, CA, or AuthRoot certificates to the Windows registry. Adversaries may install root certificates to subvert trust controls, allowing them to avoid warnings when connecting to adversary-controlled web servers or to sign malicious code that bypasses signature validation. This rule specifically looks for modifications to the 'Certificates' subkeys under 'Root', 'CA', or 'AuthRoot' paths within 'SOFTWARE\Microsoft\SystemCertificates', 'SOFTWARE\Policies\Microsoft\SystemCertificates', or 'SOFTWARE\Microsoft\EnterpriseCertificates' hives, where the 'TargetObject' ends with '\Blob' and 'Details' is 'Binary Data'.
This rule detects attempts to exploit CVE-2010-5278, a directory traversal vulnerability in MODx Revolution. Specifically, it looks for requests to `/manager/controllers/default/resource/tvs.php` with a `class_key` parameter containing a directory traversal sequence (`../../../../../../../../../../`) followed by `windows/win.ini%00`, indicating an attempt to read the `win.ini` file on a Windows server.
Detects the execution of 'MicroScMgmt.exe' as a sub-process of 'WINWORD.EXE', which is indicative of an exploit for CVE-2015-1641. This specific process creation pattern has been observed in attacks leveraging this vulnerability.
Page 498 of 680