SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,631 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of the 'hh.exe' utility when it is used to open Compiled HTML Help (.chm) files. Adversaries may abuse 'hh.exe' to execute malicious code embedded within CHM files, often as a method of defense evasion or to bypass application controls. The rule specifically looks for 'hh.exe' as the process image and the '.chm' extension in the command line arguments.
Detects the use of the .NET utility InstallUtil.exe to download files from remote HTTP or FTP sources. This technique is often used by adversaries to bypass application control and execute malicious code by leveraging a trusted, signed Microsoft binary.
Detects the execution of the "jsc.exe" (JScript Compiler). Attackers might abuse this in order to compile JScript files on the fly and bypass application whitelisting.
Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a Living Off The Land Binary (LOLBIN) to execute arbitrary commands and binaries. The rule specifically looks for command lines containing ' run run-cmd ' and excludes executions where the parent process is 'cleanapi.exe' or 'kavremover.exe', as these are legitimate parent processes for the dropped binary.
This rule detects the execution of the Windows Kernel Debugger, 'kd.exe'. While kernel debuggers are legitimate tools, their execution in a production environment can indicate attempts at defense evasion, privilege escalation, or in-depth system analysis by an adversary. The rule specifically looks for the executable name 'kd.exe' either in the image path or the original file name.
This rule detects the use of DataSvcUtil.exe, a legitimate Microsoft utility, with command-line arguments indicative of data exfiltration. Specifically, it looks for the presence of '/in:', '/out:', and '/uri:' parameters in the command line, combined with the execution of 'DataSvcUtil.exe'. This behavior is often associated with Living Off The Land Binaries (LOLBAS) techniques where adversaries leverage legitimate system tools for malicious purposes, in this case, to exfiltrate data.
This rule detects the use of the legitimate Microsoft SQL Server utility `sqldumper.exe` to dump process memory. Specifically, it looks for `sqldumper.exe` being executed with command-line arguments that indicate an attempt to dump a process, such as '0x0110' or '0x01100:40'. This technique can be abused by attackers to dump sensitive processes like LSASS (Local Security Authority Subsystem Service) to extract credentials.
This rule detects the potential for arbitrary file downloads initiated by Microsoft Office applications (Excel, PowerPoint, Word). It specifically looks for instances where these applications are executed and their command line arguments contain HTTP or HTTPS URLs, indicating an attempt to download content from the internet. This behavior can be abused by adversaries to fetch malicious payloads.
Detects the use of Plink (PuTTY Link) for suspicious remote port forwarding to a local port. This technique can be used by adversaries to bypass network restrictions and establish tunnels for command and control or data exfiltration.
Detects PowerShell command lines that contain both the 'hidden' argument and specific Base64 encoded keywords. These keywords are often associated with malicious PowerShell scripts used for various post-exploitation activities, including process injection, memory manipulation, and remote thread creation. The rule aims to identify obfuscated and stealthy execution of malicious PowerShell.
Page 520 of 680