SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,639 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of "Ldifde.exe" with the import flag "-i" and a file specified by "-f". This can be abused to import data, potentially from remote HTTP sources, leading to arbitrary file downloads or data injection.
Detects the usage of the Time Travel Debugging (TTD) utility (tttracer.exe). Adversaries can leverage tttracer.exe to execute malicious processes or dump process memory, such as LSASS, for credential access. This rule specifically looks for process creation events where tttracer.exe is the parent process, indicating its use to launch other processes.
This rule detects the execution of "VSIISExeLauncher.exe", a legitimate binary associated with Visual Studio/VS Code, when it is used to launch other executables. Adversaries may abuse this utility to proxy execution of malicious payloads, potentially bypassing application control solutions. The detection specifically looks for the execution of VSIISExeLauncher.exe combined with command-line arguments indicating the launch of another program (e.g., using '-p' or '-a').
Detects suspicious child processes spawned by the SQL Server process (sqlservr.exe). This activity is highly indicative of successful exploitation, such as Remote Code Execution (RCE) or SQL Injection, where an attacker leverages the SQL Server to execute arbitrary commands on the underlying operating system. The rule specifically looks for common system utilities and scripting interpreters that are often used by attackers for reconnaissance, persistence, or further compromise.
This rule detects the execution of the `nslookup` command specifically querying for LDAP service records (`_ldap._tcp.dc._msdcs.`). This type of query is often used during the reconnaissance phase by attackers to discover Active Directory domain controllers and their associated services within a network. This activity can indicate an adversary attempting to map out the network infrastructure.
Detects the use of 'nltest.exe' with command-line arguments indicative of reconnaissance activity, specifically targeting domain trust discovery and domain controller enumeration. Adversaries often use 'nltest.exe' to gather information about the network environment, which can aid in lateral movement and privilege escalation within Windows domains.
Detects the execution of 'ntdsutil.exe', a Windows command-line tool that can be used to perform various operations on the Active Directory database (NTDS.DIT). Adversaries may use this tool to extract credential information or other sensitive data from the NTDS.DIT file.
Detects suspicious child processes spawned from Microsoft Outlook. This often indicates an attempt to execute malicious code or scripts via social engineering or exploitation of vulnerabilities within Outlook.
This rule detects the execution of 'adidnsdump' via 'python.exe'. Adidnsdump is a tool used for enumerating and exporting all DNS records in an Active Directory integrated DNS zone. This activity is typically performed for reconnaissance purposes within internal networks, allowing an attacker to gather information about the network's structure and resources by querying/modifying DNS records via LDAP.
This rule detects the execution of Remote Utilities RAT (RURAT) executables (`rutserv.exe` or `rfusclient.exe`) or any process with 'Remote Utilities' in its product name, when they are launched from an unusual location, specifically outside of the standard 'C:\Program Files\Remote Utilities' or 'C:\Program Files (x86)\Remote Utilities' directories. This behavior can indicate an attempt to evade detection or establish persistence by placing the RAT in a non-standard path.
Page 510 of 680