SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,634 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the deletion of PowerShell console history logs, specifically the 'ConsoleHost_history.txt' file located within the 'PSReadLine' directory. Adversaries often delete these logs to remove forensic evidence of their commands and activities, making it harder for defenders to trace their actions and understand the scope of a compromise. This action is a common defense evasion technique.
This rule detects the creation of '.cmdline' files, which are artifacts generated during dynamic C# compilation. Adversaries may use dynamic C# compilation to unpack and execute payloads without writing the compiled executable to disk, making it a defense evasion technique. The rule specifically looks for the creation of these files as an indicator of such activity, particularly when initiated by processes not typically associated with C# compilation.
This rule detects the creation of files with specific naming conventions that are indicative of tools exploiting the HiveNightmare (CVE-2021-36934) vulnerability to export the Security Account Manager (SAM) database. The rule looks for various file names and patterns used by different implementations of HiveNightmare exploitation tools, including those written in Go, C++, PowerShell, and C#.
Detects the creation of a file named 'debug.bin' in the '\Temp\' directory, which is the default output filename used by the SafetyKatz tool for dumping LSASS memory. This activity is indicative of an attempt to extract credentials from the Local Security Authority Subsystem Service (LSASS) process.
This rule detects the creation of suspicious file types (e.g., executables, scripts, archives) within the `C:\PerfLogs\` directory. This directory is typically used for performance logs and primarily contains `.etl` files. The presence of other executable or script file types in this location is highly unusual and can indicate malicious activity, such as staging for execution, persistence, or data exfiltration.
Detects when legitimate Windows applications, including Microsoft Office programs and various Living Off The Land Binaries (LOLBINs), create archive files (ZIP, RAR, 7Z, diagcab, appx). This behavior is often indicative of malicious activity, such as staging data for exfiltration or dropping malicious payloads, as these applications typically should not be creating archives.
This rule detects the creation of the Process Monitor (procmon) driver file (.sys) by any process other than the legitimate Process Monitor executable itself (procmon.exe or procmon64.exe). This behavior can indicate an attempt to load a malicious or unauthorized driver, potentially for privilege escalation or persistence, by masquerading as a legitimate system utility.
Detects the creation of the PSEXEC key file, which is generated whenever a PsExec command is executed. This file is written to the file system and recorded in the USN Journal on the target system, serving as an indicator of PsExec activity.
Detects the creation or modification of 'WsmPty.xsl' or 'WsmTxt.xsl' files outside of the standard Windows system directories. This activity is indicative of an application whitelisting bypass technique involving 'winrm.vbs' and 'cscript.exe' to execute attacker-controlled XSL files.
This rule detects when 'credui.dll' or 'wincredui.dll' is loaded by a process that is not commonly associated with these DLLs. Attackers might load these DLLs to interact with Windows Credential Provider functions like 'CredUIPromptForCredentials' or 'CredUnPackAuthenticationBufferW' to prompt users for credentials or extract them.
Page 517 of 680