SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,639 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of SysInternals DebugView when its executable name has been renamed from the original 'Dbgview.exe'. This can indicate an attempt to evade detection or obscure the use of the tool by an adversary.
Detects the execution of suspicious files that use a double extension in their name, specifically when these files appear in the ParentImage or ParentCommandLine. This technique is often used by adversaries to masquerade malicious executables as benign document or script files, tricking users into executing them.
Detects the execution of Living Off The Land Binaries (LOLBINs) from an unusual or abnormal drive, such as a mounted ISO. This behavior can indicate an attempt by an adversary to evade detection by executing legitimate system tools from non-standard locations, often associated with initial access or defense evasion techniques.
Detects potential credential dumping via the Windows Error Reporting (WER) LSASS Shtinkering technique. This technique abuses WerFault.exe to dump the LSASS process memory. The rule specifically looks for WerFault.exe being executed with command-line arguments indicating a dump of a target process (-p) that is not the source process (-ip), and where the target process is likely LSASS.
Detects an attempt to execute code or create a service on a remote host using `winrm.vbs` via `cscript.exe`. This technique leverages Windows Remote Management (WinRM) to interact with WMI for remote execution, often for lateral movement or persistence.
This rule detects the execution of 'wmic.exe' with the 'Product' keyword in the command line. This specific command is often used by adversaries to enumerate installed software, including security products like firewalls and antivirus, on a Windows system. This activity is typically part of the discovery phase of an attack, where an attacker gathers information about the environment to plan subsequent actions.
Detects the setting of the "DumpType" registry value to "2" (Full Dump) within the Windows Error Reporting LocalDumps configuration. This specific setting is required by techniques like LSASS Shtinkering to facilitate dumping of the LSASS process memory, which often contains sensitive credential material.
Detects when an attacker registers a new SIP provider for persistence and defense evasion by monitoring modifications to the 'mpnotify' registry key under 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\'. This registry key is associated with Winlogon helper DLLs, which can be abused to execute malicious code during user logon.
This rule detects Sysmon Event ID 27, which signifies a "FileBlockExecutable" event. This event is generated when Sysmon's configured block policy prevents an executable file from being created or modified. This indicates an attempt to introduce or alter an executable that violates the defined security policy.
This rule detects the invocation of the 'Archer' malware using 'rundll32.exe'. Specifically, it looks for command-line arguments containing both 'rundll32.exe' and 'InstallArcherSvc'. This pattern indicates an attempt to execute a malicious DLL function named 'InstallArcherSvc' via the legitimate Windows utility 'rundll32.exe', which is a common technique for defense evasion and execution.
Page 511 of 680