SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,641 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of script files (JSE, VBE, JS, VBA, VBS) in common user or program data directories by wscript.exe or cscript.exe. This behavior is often associated with malware droppers or initial access techniques.
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network. This rule specifically looks for file events where the 'System' process is writing to 'iertutil.dll' within the 'Internet Explorer' directory, which could indicate an attempt to replace or modify a legitimate DLL for malicious purposes, potentially leveraging DCOM for remote execution.
This rule detects the creation of a batch file by PowerShell, specifically looking for files ending with '.bat' when the creating process is 'powershell.exe' or 'pwsh.exe'. This behavior is indicative of the Powerup tool's 'Write Hijack DLL' functionality, which creates a self-deleting batch file (often named 'debug.bat') to execute malicious commands for DLL hijacking and privilege escalation.
Detects the creation of suspicious files and folders inside the user's AppData folder but not within the common and well-known subdirectories (Local, Roaming, LocalLow). This technique can be used by adversaries to bypass detections that exclude common AppData paths to reduce false positives.
Detects the creation of files with '.one' or '.onepkg' extensions in suspicious or uncommon locations, which could indicate the abuse of OneNote attachments for malware delivery. The rule specifically excludes files created by the legitimate OneNote application running from its standard installation path.
Detects the creation of new PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories. This activity can indicate an adversary attempting to establish persistence or load malicious modules.
Detects the creation of Rclone configuration files, which are typically stored in a specific user directory path. Rclone is a command-line program used for syncing files with various cloud storage services and is often leveraged by adversaries for data exfiltration.
Detects specific filenames associated with Winnti dropper activity, as detailed in the RedMimicry Winnti playbook. The rule looks for the creation or modification of 'gthread-3.6.dll', 'sigcmm-2.4.dll', or 'Windows\Temp\tmp.bat', which are known indicators of compromise for Winnti malware.
Detects when specific legitimate Windows applications or LOLBINs (Living Off the Land Binaries) create script files on disk. This behavior is often indicative of malicious activity where adversaries leverage trusted processes to drop and execute malicious scripts, bypassing security controls.
Detects the creation or modification of PowerShell profile scripts (profile.ps1) in various common locations. Adversaries may modify these profiles to include arbitrary commands, functions, or modules to gain persistence or elevate privileges, as the profile script runs automatically when PowerShell starts.
Page 507 of 680