SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,627 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects usage of the "type" command to download/upload data from WebDAV server. This technique can be used by adversaries to transfer files into or out of a compromised environment.
Detects the execution of "ConfigSecurityPolicy.EXE" with command-line arguments containing URLs (ftp://, http://, https://). This Windows Defender binary can be abused by attackers to download or upload files, potentially leading to arbitrary file download or data exfiltration.
This rule detects the execution of 'csc.exe' (C# compiler) in suspicious file system locations. Attackers often use csc.exe to compile .NET code on the fly, enabling them to bypass traditional defenses and execute malicious code during later stages of an attack. The rule specifically looks for csc.exe execution where the command line arguments indicate compilation in temporary directories, user-specific folders like Public, AppData\Local\Temp, or other common user-writable locations that are not typically used for legitimate software compilation.
Detects suspicious execution of the Microsoft desktopimgdownldr utility. This utility is being used with parameters to download files from the Internet, specifically when the '/lockscreenurl:' argument is present and the downloaded file is not a common image format (like .jpg, .jpeg, or .png), or when it's used in conjunction with 'reg delete' and '\PersonalizationCSP' to potentially manipulate system settings related to personalization. This behavior can indicate an adversary attempting to download malicious payloads or modify system configurations.
Detects the creation of suspicious child processes by hh.exe (Microsoft HTML Help). Adversaries often abuse hh.exe to proxy execution of other malicious binaries or scripts, leveraging it as a LOLBIN (Living Off The Land Binary) to bypass defenses. The rule specifically looks for hh.exe launching common system utilities that can be used for malicious purposes, such as CertReq.exe, CertUtil.exe, cmd.exe, cscript.exe, installutil.exe, MSbuild.exe, MSHTA.EXE, msiexec.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, schtasks.exe, wmic.exe, and wscript.exe.
This rule detects the execution of PowerShell with specific command-line obfuscation patterns known to be used by the CrackMapExec (CME) penetration testing framework. The rule looks for PowerShell executable names and specific string patterns within the command line that CME uses for obfuscation, such as 'join*split', '( $ShellId[1]+$ShellId[13]+''x'')', '( $PSHome[*]+$PSHOME[*]+', '( $env:Public[13]+$env:Public[5]+''x'')', and '( $env:ComSpec[4,*,25]-Join'''')'. These patterns are designed to evade simple string-based detections.
Detects suspicious process patterns indicative of CrackMapExec (CME) being used to dump LSASS credentials. The rule looks for specific command-line arguments used by CME for LSASS dumping, including combinations of 'tasklist' with 'Imagename eq lsass.exe', 'rundll32.exe' with 'comsvcs.dll' and temporary paths, and 'tasklist' with 'findstr /i "lsass"'. These patterns are commonly observed when attackers attempt to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory.
Detects the use of `cmd.exe` to launch PowerShell commands that leverage `clip.exe` and the Windows clipboard for obfuscated execution. This technique is often used to evade detection by breaking up malicious payloads or commands.
This rule detects the creation of child processes by SysAidServer, specifically when the parent process is either 'java.exe' or 'javaw.exe' and its command line contains 'SysAidServer'. This activity has been observed in intrusions attributed to the MERCURY (MuddyWater) threat actor, suggesting potential exploitation or unauthorized execution within the SysAid environment.
Detects the execution of 'CustomShellHost.exe' where its child process is not 'C:\Windows\explorer.exe'. This behavior can indicate an attempt to use CustomShellHost for proxy execution, potentially bypassing security controls or for defense evasion.
Page 534 of 680