SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,634 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the loading of a DLL associated with the SILENTTRINITY stager, specifically looking for the string 'st2stager' in the DLL's description.
This rule detects when an unsigned image (DLL or EXE) is loaded into the Local Security Authority Subsystem Service (LSASS) process. Adversaries often inject malicious, unsigned code into LSASS to dump credentials, as LSASS stores sensitive authentication material. Detecting unsigned code in this critical process can indicate an attempt at credential dumping or other forms of privilege escalation.
This rule detects when a Common Language Runtime (CLR) DLL, specifically 'clr.dll', is loaded by any of the specified Microsoft Office applications (Excel, Publisher, Outlook, OneNote, PowerPoint, Word). This activity can be indicative of malicious code execution, as adversaries might leverage CLR to execute .NET assemblies within the context of a legitimate Office process, potentially bypassing security controls or achieving persistence.
Detects when a DLL from the Global Assembly Cache (GAC) is loaded by a Microsoft Office application. This behavior can be indicative of malicious activity, such as DLL hijacking or persistence mechanisms, where an attacker might try to load their own malicious DLLs disguised as legitimate GAC assemblies through Office applications.
This rule detects when Microsoft Excel loads an Add-In (.xll) file from an uncommon or potentially suspicious location. Adversaries often use XLL files for initial access or execution by embedding malicious code within them, and loading them from non-standard directories like Desktop, Downloads, Temp, or Public user folders can indicate malicious activity. The rule specifically looks for excel.exe loading an .xll file from a predefined list of suspicious directories.
Detects when a Microsoft Office application (Excel, Publisher, Outlook, OneNote, PowerPoint, Word) loads a PowerShell core DLL. This behavior is highly suspicious as Office applications typically do not need to load PowerShell DLLs, and it can indicate an attempt to execute PowerShell code within the context of a trusted Office application, potentially for defense evasion or malicious scripting.
Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicate a remote PowerShell connection, often associated with Windows Remote Management (WinRM). The rule filters out connections from common network service accounts and localhost to reduce false positives.
Detects the creation of the default named pipe for PsExec (PSEXESVC) when the PsExec executable is run from suspicious locations such as temporary directories, public user folders, or common download/desktop locations. This activity can indicate the use of PsExec by an attacker.
This rule detects the use of 'powercat' or 'powercat.ps1' within PowerShell classic logs. Powercat is a PowerShell-based network utility similar to Netcat, often used by adversaries for network communication, including reverse shells, bind shells, and file transfers, potentially bypassing traditional network controls. This activity is indicative of command and control communication or lateral movement using non-application layer protocols.
This rule detects the use of the 'Get-Clipboard' command within PowerShell logs. This command allows an adversary to retrieve the current content of the system clipboard, which could contain sensitive information copied by a user.
Page 518 of 680