SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,625 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of the AutoHotkey.exe binary when it has been renamed. It identifies this by looking for specific PE metadata fields such as 'Product' or 'Description' containing 'AutoHotkey', or 'OriginalFileName' being 'AutoHotkey.exe' or 'AutoHotkey.rc', while simultaneously filtering out executions where the image path ends with or contains the legitimate 'AutoHotkey.exe' or its variants.
Detects the execution of a renamed Plink binary, which is often used by adversaries for SSH tunneling and data exfiltration. The rule specifically looks for the original filename 'Plink' combined with command-line arguments indicative of port forwarding ('-l forward', '-P', '-R'), while filtering out legitimate executions of 'plink.exe' to reduce false positives.
Detects the execution of PsExec's service component (psexesvc.exe) when it has been renamed. This often indicates an attempt to evade detection by security tools that monitor for the default service name, as legitimate administrators typically use the original name.
This rule detects the execution of 'rundll32.exe' with specific command-line arguments ('keymgr' and 'KRShowKeyMgr') which indicates an attempt to invoke the Stored User Names and Passwords dialogue, also known as the Key Manager. This activity can be used by adversaries to access or backup stored credentials.
This rule detects the use of the `sc.exe` utility to modify the security descriptor of a Windows service. Specifically, it looks for the `sdset` command-line argument, which can be used to grant special permissions to a service, potentially allowing it to be hidden or manipulated for persistence and defense evasion. This technique can be used by adversaries to maintain access and avoid detection by making services less visible to standard enumeration tools.
Detects when adversaries delete important scheduled tasks using `schtasks.exe` to disrupt system functionality or security mechanisms. The rule specifically targets the deletion of tasks related to critical Windows components like BitLocker, ExploitGuard, SystemRestore, UpdateOrchestrator, Windows Defender, WindowsBackup, and WindowsUpdate, which can indicate an attempt to disable or interfere with essential system services or security features.
Detects the installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.
Detects the use of the 'shutdown.exe' command-line tool with the '/l' argument, which is used to log off the current user. This activity is considered rare and potentially suspicious as it can be used by adversaries to disrupt user sessions or as part of system manipulation tactics.
Detects command line activity that attempts to clear or disable Event Tracing for Windows (ETW) trace logs. This behavior is indicative of logging evasion, where an attacker tries to remove or prevent the collection of forensic evidence.
Detects a suspicious process command line where 'whoami' is used as the first parameter, which can be indicative of privilege escalation techniques like those used by EfsPotato. This rule specifically looks for '.exe whoami' in the command line.
Page 537 of 680