SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,631 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious manipulations of default accounts such as 'administrator' and 'guest' using `net.exe` or `net1.exe`. This includes actions like enabling/disabling accounts or changing passwords, which are often performed by adversaries for persistence or impact.
Detects the usage of the `netsh.exe` command-line utility to modify system firewall rules, specifically to open port 3389 for RDP connections. This activity has been observed in campaigns involving the Sarwent malware, where adversaries manipulate firewall settings to enable remote access.
Detects the execution of 'nltest.exe', a Windows command-line utility that can be used by adversaries for information discovery, specifically to enumerate domain trusts and discover system network configurations.
This rule detects suspicious execution of 'Powercfg.exe' to modify power settings related to the lock screen timeout. Adversaries may use this technique to prevent a system from entering a dormant state, thereby maintaining access and hindering defensive mechanisms. The rule specifically looks for command-line arguments that change the AC (alternating current) or DC (direct current) standby timeout, or modify the video display timeout when the system is locked.
Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly" within process command lines. This technique is often used by malware to dynamically load assemblies, evading static analysis.
Detects attempts to disable or modify Microsoft Defender features using PowerShell commands, specifically targeting various scanning and monitoring capabilities. The rule looks for `Add-MpPreference` or `Set-MpPreference` cmdlets combined with parameters like `DisableArchiveScanning`, `DisableRealtimeMonitoring`, `DisableIOAVProtection`, `DisableBehaviorMonitoring`, `DisableBlockAtFirstSeen`, `DisableCatchupFullScan`, or `DisableCatchupQuickScan` set to `$true` or `1`. It also includes detection for base64 encoded versions of these commands.
Detects the execution of Ngrok, a legitimate utility often abused by threat actors for port forwarding and tunneling. This allows them to expose local services to the internet, bypassing firewalls and network restrictions. The rule specifically looks for common command-line arguments used with Ngrok, such as those for tunneling specific TCP ports (e.g., 139, 445, 3389, 5985, 5986), HTTP services, or configuration file usage.
Detects the usage of "reg.exe" to add Windows Defender folder exclusions. This technique has been observed being used by QakBot (formerly Qbot) to add exclusions for folders within AppData and ProgramData, aiming to evade detection by the antivirus software.
This rule identifies the use of `net.exe`, `net1.exe`, or `w32tm.exe` commands to query system time or time zone information. Adversaries may use these commands to gather information about a target system's time settings, potentially before executing scheduled tasks or to understand the system's geographical context.
This rule detects suspicious execution of 'rundll32.exe' when it attempts to load 'advpack.dll' and specifically calls functions using an obfuscated ordinal number (e.g., '#12' or '#-'). This technique is often used by adversaries to leverage the 'RegisterOCX' function for defense evasion, as it can bypass security monitoring that might not scrutinize rundll32.exe's normal operations or direct DLL function calls.
Page 528 of 680