SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,632 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of a specific '.url' file named 'file001.url' within the 'Recent' folder of Microsoft Office. This activity has been observed in potential exploitation attempts related to CVE-2023-36884, where adversaries drop such files to achieve persistence or execute malicious code.
Detects the creation of an 'svchost.exe' process with specific command line flags ('-k msupdate', '-k msupdate2', or '-k alg') that have been observed in use by the ColdSteel RAT for persistence and defense evasion. This pattern indicates the RAT establishing itself as a service to maintain access on a compromised system.
Detects the creation of a Windows service named "WerFaultSvc" with a specific ImagePath pattern, which has been identified as a persistence mechanism used by the SNAKE malware (also known as EKANS) as described in CISA reports. The rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, where the service name contains 'WerFaultSvc' and the ImagePath starts with 'C:\Windows\WinSxS\' and ends with '\WerFault.exe'.
Detects unusually long PowerShell command lines (1000 characters or more) which can be indicative of obfuscated or complex malicious scripts being executed. Attackers often use long command lines to evade detection by packing malicious code, base64 encoded commands, or other obfuscation techniques into a single line.
This rule identifies when a suppression rule is created in Azure. Adversaries might create suppression rules to evade detection by preventing security alerts from being generated or displayed for their malicious activities.
Detects when highly privileged delegated permissions are granted on behalf of all users in Azure Active Directory. This can indicate an attempt to gain broad access to resources by an application.
Detects the usage of the 'base64' utility with the decode flag ('-d' or '--decode') on Linux systems. This activity can indicate an adversary attempting to deobfuscate or decode base64-encoded text, which is a common technique for hiding malicious payloads or commands.
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for distinct string manipulation and variable concatenation techniques used by the framework within the ServiceFileName field of Windows Security Event ID 4697.
This rule detects the creation of a new Windows service where the ImagePath contains 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell'. This specific combination is indicative of an attempt to execute obfuscated PowerShell code via rundll32.exe, a common technique for defense evasion and execution.
This rule detects the creation of files with a '.dll' extension that have names matching known Windows system DLLs (e.g., 'secur32.dll', 'tdh.dll') but are created in unusual or non-standard system directories. The rule specifically excludes common legitimate system directories like 'System32' and 'SysWOW64' to reduce false positives. This behavior can indicate an attempt at DLL sideloading or other defense evasion techniques where an attacker places a malicious DLL with a legitimate system DLL name in a location that a legitimate application might load it from.
Page 523 of 680