SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,631 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in, which is a common method for privilege escalation and persistence.
This rule detects the usage of path traversal techniques within the command line of 'conhost.exe'. This behavior can indicate an attempt to confuse or hijack command arguments, potentially leading to indirect command execution. Specifically, it looks for '/../../' in the command line when 'conhost' is present in the parent command line.
Detects the execution of "csvde.exe" with the '-f' flag, indicating an attempt to export the Active Directory structure. This tool is often used by adversaries for discovery and collection of domain account information.
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe". These interpreters can be used by adversaries for application whitelisting bypass and to execute F# code via scripts or inline, potentially for malicious purposes.
Detects the execution of SharpLdapWhoami, a tool designed to query LDAP services on a domain controller to identify the current user, similar to the 'whoami' command. The rule looks for the executable name, original filename, product name, and specific command-line arguments related to authentication methods.
This rule detects suspicious registration of IIS modules, a technique used by adversaries to establish persistence on web servers. It specifically looks for `w3wp.exe` (IIS worker process) as the parent process executing commands related to adding modules via `appcmd.exe`, or using PowerShell with `system.enterpriseservices.internal.publish`, or using `gacutil` with the `/I` flag. These activities are indicative of malicious IIS extensions or backdoors being installed, as described in Microsoft's threat report on IIS backdoors.
Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution. This technique involves using wscript.exe or cscript.exe to execute manage-bde.wsf, which in turn can be used to execute other commands or scripts, bypassing certain security controls.
Detects execution of commands and binaries from the context of the Program Compatibility Assistant (Pcalua.exe). This can be used as a Living Off The Land Binary (LOLBIN) to bypass application whitelisting.
This rule detects the execution of 'remote.exe', a legitimate utility part of WinDbg in the Windows SDK. Adversaries can abuse remote.exe for application whitelisting (AWL) bypass and to execute remote files, making it a living-off-the-land binary (LOLBin). The detection is based on the image path ending with '\remote.exe' or the original filename being 'remote.exe'.
This rule detects the execution of PowerShell code through the `sqltoolsps.exe` utility, which is part of Microsoft SQL Server Management Studio. This method can be used to bypass logging mechanisms for script blocks, making it a technique for defense evasion.
Page 527 of 680