SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,641 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of a Chromium-based browser process with the "--headless" flag and a URL pointing to mockbin.org or run.mocky.io. This activity can indicate an attempt to exfiltrate data or use the browser in an automated, potentially malicious, fashion without a visible user interface.
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen. This rule specifically looks for processes like cmd.exe or powershell.exe being launched by winlogon.exe, with command-line arguments indicating an attempt to leverage Windows accessibility features such as sethc.exe (Sticky Keys), utilman.exe (Utility Manager), osk.exe (On-Screen Keyboard), Magnify.exe, Narrator.exe, or DisplaySwitch.exe.
Detects suspicious usage of curl.exe to download files to sensitive or temporary locations on Windows systems. This rule specifically looks for curl.exe processes that output downloaded content to common temporary directories, user-specific application data folders, public user folders, or the desktop, often with suspicious file extensions. This behavior is frequently associated with malware staging or initial access techniques.
This rule detects the use of the 'dsacls.exe' utility to grant potentially over-permissive permissions on Active Directory objects. It specifically looks for the execution of 'dsacls.exe' with the '/G' flag, which is used to grant permissions, combined with common permission flags like 'GR' (Generic Read), 'GE' (Generic Execute), 'GW' (Generic Write), 'GA' (Generic All), 'WP' (Write Property), or 'WD' (Write DACL). This combination suggests an attempt to broaden access controls, which could be a legitimate administrative action or an adversary attempting to escalate privileges or maintain persistence.
Detects suspicious execution of Microsoft HTML Help (hh.exe) when it is launched from unusual or temporary directories, or with command-line arguments indicating potential malicious activity. Adversaries often abuse hh.exe to execute malicious code embedded within Compiled HTML (CHM) files, leveraging it as a living-off-the-land binary to bypass defenses and execute payloads. The rule specifically looks for hh.exe being executed from common temporary or user download paths, which are frequently used for initial access or staging.
Detects the use of Jlaive, a hack tool, to execute assemblies in a copied PowerShell instance. This technique involves using `xcopy.exe` to copy `powershell.exe` or `pwsh.exe` to a new name ending with `.bat.exe`, and then using `attrib.exe` to set system and hidden attributes on this file, likely to evade detection and execute malicious code.
Detects obfuscated PowerShell commands executed via `cmd.exe` using the VAR++ LAUNCHER technique. This method involves using `cmd.exe`'s `&&set` command to define variables that are then used in conjunction with string formatting (`-f` and `{0}` style placeholders) to construct and execute PowerShell commands, often involving `Invoke-Expression` and `DownloadString` for remote code execution.
Detects the execution of Quarks PwDump, a tool used for dumping credentials, by monitoring process creation events for its executable name and specific command-line arguments. The rule looks for 'QuarksPwDump.exe' and various flags associated with dumping local hashes, domain cached hashes, BitLocker keys, and domain hashes, including those from NTDS files.
Detects the execution of PowerShell with a specific flag sequence ('-NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc') that is characteristic of the Wmiexec script, often used for lateral movement and defense evasion.
Detects the execution of 'IEExec.exe' with command-line arguments containing 'http://' or 'https://', indicating an attempt to download and execute files from a remote web server. This utility is part of the .NET Framework and can be abused by adversaries for ingress tool transfer.
Page 509 of 680