SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,623 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation of child processes by 'cmstp.exe', the Microsoft Connection Manager Profile Installer. Adversaries often abuse cmstp.exe to proxy execution of malicious code, bypass User Account Control (UAC), or evade application control defenses by loading and executing DLLs or COM scriptlets. This detection specifically looks for any process that has 'cmstp.exe' as its direct parent.
This rule detects the execution of `fsutil.exe` with specific command-line arguments to set `SymlinkEvaluation`. This action can be used by adversaries, such as ransomware, to enable symbolic link following, potentially allowing them to access and encrypt files through shortcuts or junctions that would otherwise be inaccessible.
This rule detects the creation of suspicious child processes by 'GoogleUpdate.exe'. It specifically looks for any child process that is not a known legitimate Google-related executable (e.g., other GoogleUpdate components, GoogleCrashHandler, or specific setup/installer executables like 'setup.exe', 'chrome_updater.exe', 'chrome_installer.exe'). This behavior could indicate an attempt to leverage a legitimate Google process for malicious activity, such as defense evasion or persistence.
This rule detects suspicious invocations of the `fsutil.exe` utility, specifically when it's used to delete the USN journal, create a USN journal with a small size, or set zero data to a file. These actions are often associated with ransomware or other malicious activity aimed at defense evasion and data destruction, as seen in campaigns like NotPetya and Lockbit.
Detects the use of Cobalt Strike commands entered into the command shell. This rule specifically looks for common Cobalt Strike post-exploitation commands such as 'psinject', 'spawnas', 'make_token', 'remote-exec', 'rev2self', 'dcsync', 'logonpasswords', 'execute-assembly', and 'getsystem' when executed via cmd.exe. This often indicates an operator error where Cobalt Strike commands are mistakenly typed directly into a compromised system's command prompt instead of the Cobalt Strike beacon console.
This rule detects the execution of the password guessing hack tool Hydra based on specific command-line parameters. It looks for the presence of '-u ' and '-p ' which are commonly used to specify username and password lists, respectively. Additionally, it checks for the keywords '^USER^' and '^PASS^' which are often used as placeholders in Hydra's command-line arguments for iterating through user and password lists during a brute-force attack.
This rule detects attempts to disable HTTP logging on a Windows Internet Information Services (IIS) web server using the 'appcmd.exe' utility. Specifically, it looks for command-line arguments that set the 'httplogging' section with 'dontLog:true'. This activity is associated with defense evasion tactics, as observed by threat groups like Threat Group-3390 (Bronze Union), to remove forensic evidence of their activities.
Detects the use of 'aspnet_regiis.exe' with specific command-line arguments to decrypt Microsoft IIS connection strings. This activity is indicative of an attacker, potentially with web shell access, attempting to extract sensitive credentials like MSSQL service account passwords from IIS configurations.
Detects the use of the 'Ilasm.exe' utility to compile C# Intermediate Language (IL) code into executable (EXE) or dynamic-link library (DLL) files. This activity can be indicative of an adversary compiling malicious code on a compromised system, potentially to bypass security controls or execute custom payloads.
This rule detects the suspicious execution of InstallUtil.exe, a legitimate .NET utility, when it is used to execute an image without logging its activity. Adversaries often leverage InstallUtil.exe for defense evasion and bypassing application control by executing malicious code through a trusted, signed Microsoft binary. The specific conditions for detection are the execution of InstallUtil.exe from a Microsoft .NET Framework directory with command-line arguments that disable logging (`/logfile= ` and `/LogToConsole=false`). This behavior is indicative of an attempt to hide malicious activity.
Page 542 of 680