SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,625 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects indirect command execution by monitoring for processes where 'pcwrun.exe' is the parent process. 'pcwrun.exe' is part of the Program Compatibility Assistant and can be abused to proxy execution of other commands or binaries, a technique often used for defense evasion.
Detects the execution of PowerShell scripts via 'Runscripthelper.exe' when the command line contains 'surfacecheck'. This behavior is suspicious as 'Runscripthelper.exe' is a legitimate Windows binary that can be abused for indirect command execution, often as part of Living Off The Land Binaries and Scripts (LOLBAS) techniques.
Detects the usage of the "sftp.exe" binary as a Living Off The Land Binary (LOLBIN) by abusing the "-D" flag to potentially execute arbitrary commands or binaries. This technique can be used for defense evasion or execution.
Detects the execution of the Visual Basic Command Line Compiler (vbc.exe) where it acts as a parent process to the Windows Resource to Object Converter (cvtres.exe). This combination indicates successful code compilation, which can be abused by adversaries to compile malicious code on a compromised system.
Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution. This rule specifically looks for common scripting and system utilities being launched as child processes of mshta.exe, which is often abused for defense evasion and execution.
Detects when the 'net.exe' or 'net1.exe' utility is used with the 'share' and '/delete' commands to remove a mounted network share. This activity can be performed by adversaries to clean up traces of their operations.
Detects the execution of netsh with the "add helper" flag to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy, getting called whenever netsh.exe is executed.
Detects the execution of the PDQ Deploy Console, which is a remote administration tool. This rule identifies the creation of processes associated with the PDQ Deploy Console based on its description, product name, company, or original file name. This tool can be used for legitimate software deployment but can also be leveraged by adversaries for execution and lateral movement.
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on remote machines. The rule specifically looks for PDQDeployRunner spawning suspicious child processes, executing commands with suspicious arguments, or executing from suspicious paths, which could indicate abuse for malicious purposes.
Detects PowerShell execution that includes base64 encoded WMI class names such as "Win32_ShadowCopy", "Win32_ScheduledJob", "Win32_Process", "Win32_UserAccount", or "Win32_LoggedOnUser" in the command line. This technique is often used by adversaries to obfuscate their actions and evade detection.
Page 535 of 680