SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,632 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the usage of the 'sqlite' or 'sqlite3' binaries to query specific database files associated with Firefox and other Gecko-based browsers, such as 'cookies.sqlite' and 'places.sqlite'. This activity is indicative of potential data stealing, particularly targeting browser history, bookmarks, and session cookies.
This rule detects suspicious patterns in program names or command-line arguments that are commonly associated with malicious samples, hacktools, or exploit kits. It looks for specific keywords and file names in the 'Image' (executable path) and 'CommandLine' fields. Examples include CVE-related strings, common exploit/artifact names like 'poc.exe', 'meterpreter', and various PowerShell scripts often used in post-exploitation such as 'inject.ps1', 'Invoke-CVE', 'mimikatz.ps1', and 'powercat.ps1'.
This rule detects attempts to enable Windows developer features such as 'Developer Mode' or 'Application Sideloading' via 'SystemSettingsAdminFlows.exe'. Enabling these features allows users to install untrusted packages, which can be leveraged by adversaries for defense evasion or persistence by bypassing standard application signing requirements.
Detects suspicious UltraVNC command line flag combinations that indicate an auto-reconnect upon execution, often used for persistence or remote access. This behavior has been observed in campaigns by the Gamaredon threat group.
Detects attempts to uninstall or terminate security products using the Windows Management Instrumentation Command-line (WMIC) utility. Adversaries often disable or remove security software to evade detection and facilitate their malicious activities. This rule specifically looks for WMIC commands that target common security product names and attempt to uninstall or terminate them.
Detects changes to the registry for the currently logged-in user to disable PowerShell module logging, script block logging, transcription, or script execution logging. This activity is often performed by adversaries to evade detection by hindering forensic analysis and logging capabilities.
This rule detects the installation or modification of keyboard preload settings in the Windows Registry, specifically looking for suspicious keyboard layouts such as Persian (Iran) or Vietnamese. This activity is considered suspicious in environments where such layouts are not expected, particularly in systems maintained by US staff. The detection focuses on changes to the 'Keyboard Layout\Preload' and 'Keyboard Layout\Substitutes' registry keys.
Detects potential exploitation of CVE-2021-40444, a Microsoft MSHTML Remote Code Execution vulnerability, by identifying suspicious process patterns. Specifically, it looks for 'control.exe' being spawned by Microsoft Office applications (Winword, Powerpnt, Excel) with command-line arguments that do not match known benign patterns for 'control.exe input.dll'. This behavior has been observed in in-the-wild exploitations of this vulnerability.
Detects a specific broken command line argument 'choice /t %d /d y /n >nul' used by the Goofy-Guineapig backdoor, as detailed in the NCSC report. This command is likely an attempt to introduce a delay or interact with a prompt in a non-standard way, which could indicate malicious activity.
Detects attempts to exploit the VMware Workspace ONE Access Admin Remote Code Execution vulnerability (CVE-2022-31659) by monitoring for POST requests to the '/SAAS/jersey/manager/api/migrate/tenant' URI. This URI is associated with the migration API, and suspicious activity here could indicate an attacker attempting to leverage the vulnerability for remote code execution.
Page 522 of 680