SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,623 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects suspicious PowerShell script blocks that contain specific .NET classes often used in LDAP-based credential access attempts. The presence of 'System.DirectoryServices.Protocols.LdapDirectoryIdentifier', 'System.Net.NetworkCredential', and 'System.DirectoryServices.Protocols.LdapConnection' within a PowerShell script block suggests an attempt to interact with an LDAP directory, potentially for password guessing or brute-force attacks against accounts.
This rule detects PowerShell commands that perform reconnaissance activities (getting services, child items, or processes) and redirect their output to a file in the temporary directory. This behavior is indicative of an adversary collecting internal system information for potential exfiltration or further analysis.
This rule detects the use of 'X509Enrollment' objects within PowerShell scripts. Adversaries may use X509Enrollment to install root certificates, which can be leveraged to bypass security warnings when connecting to adversary-controlled web servers or to sign malicious code, thereby subverting trust controls and enabling defense evasion.
Detects attempts to dump LSASS process memory using WerFault.exe. This technique is often used by tools like Mimikatz, NanoDump, Invoke-Mimikatz, Procdump, or Taskmgr to extract credentials from the Local Security Authority Subsystem Service (LSASS) process. The rule specifically looks for WerFault.exe accessing lsass.exe with a GrantedAccess of '0x1FFFFF', which indicates full access.
This rule detects a User Account Control (UAC) bypass technique that leverages a WoW64 logger DLL hijack, specifically referencing UACMe method 30. It identifies process access events where the source image is located in 'C:\Windows\SysWOW64\', requests full access ('0x1fffff'), and exhibits an unknown call trace pattern starting with 'UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|'. This combination of indicators suggests an attempt to elevate privileges by injecting a malicious DLL into a trusted process.
This rule detects the use of 7-Zip to compress and password-protect data, which is a common technique used by adversaries for exfiltration. It specifically looks for the execution of 7-Zip executables (7z.exe, 7zr.exe, 7za.exe) combined with command-line arguments indicating both compression/archiving ('a' or 'u') and password protection ('-p').
Detects suspicious child processes spawned by "aspnet_compiler.exe". This often indicates an adversary is abusing the legitimate `aspnet_compiler.exe` utility for proxy execution, potentially to bypass application controls or execute malicious code from unexpected locations. The rule specifically looks for common executables like `calc.exe` or `notepad.exe` and processes launched from suspicious temporary or user-specific directories.
Detects the use of the built-in Windows utility 'cipher.exe' with the '/w:' argument to overwrite deleted data on disk. This technique is often used by adversaries to destroy data and files, making them irrecoverable by forensic methods, thereby impacting system availability.
Detects a possible process memory dump of lsass.exe using a renamed or masqueraded executable named 'TrolleyExpress.exe'. This technique leverages the whitelisted nature of the legitimate Citrix TrolleyExpress.exe to evade detection while attempting to dump LSASS memory, often indicated by command-line arguments targeting process IDs in the 700-999 range or the '-ma' flag for memory dumping.
Detects potential path traversal attempts via cmd.exe, which could indicate command or argument confusion/hijacking. The rule looks for cmd.exe being executed with command line arguments containing '/c', '/k', or '/r' and a path traversal sequence like '/../../'.
Page 541 of 680