SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,623 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation of suspicious shell processes or system utilities spawned by the Java utility 'keytool.exe'. This behavior is often indicative of exploitation, such as the CVE-2021-40539 vulnerability in ManageEngine ADSelfService Plus, where attackers leverage keytool to execute arbitrary commands. The rule specifically looks for 'keytool.exe' as the parent process and a wide range of common Windows and Linux shell/utility executables as the child process.
This rule detects the creation of a Java process that is configured for remote debugging, specifically when the debugging interface is bound to an address other than localhost (127.0.0.1 or localhost). This configuration allows external connections to the Java Debug Wire Protocol (JDWP) port, which can be exploited by attackers to gain control over the Java application or the underlying system. The rule looks for the 'transport=dt_socket,address=' string in the command line, combined with the absence of 'address=127.0.0.1' or 'address=localhost'. It also includes a check for older JVM versions ('jre1.' or 'jdk1.') which might be more vulnerable.
Detects the execution of the Microsoft-signed PowerShell script 'Launch-VsDevShell.ps1' with specific command-line arguments ('VsWherePath ' or 'VsInstallationPath '). This script can be abused to proxy the execution of other commands, potentially for defense evasion.
This rule detects the execution of 'ScriptRunner.exe' with the '-appvscript' command-line argument. 'ScriptRunner.exe' is a legitimate Windows binary that can be abused to proxy execution, potentially bypassing whitelisting or other security controls. This specific command-line argument indicates its use in the context of App-V scripting, which can be leveraged for malicious purposes.
This rule detects attempts to remove Windows Defender definition files using the MpCmdRun.exe utility with the '-RemoveDefinitions -All' command-line arguments. This action is typically performed by adversaries to disable or impair Windows Defender's ability to detect malicious software, thereby facilitating their activities and avoiding detection.
Detects the execution of 'netsh.exe' with the 'trace' and 'start' flags, indicating that a network trace capture has been initiated. This activity can be used by adversaries for network sniffing to gather information about the environment, including credentials or network configurations.
Detects the execution of "odbcconf.exe" with the "INSTALLDRIVER" argument, which is used to install new ODBC drivers. Attackers often abuse this legitimate Windows utility to install and execute malicious DLLs, bypassing application control solutions and achieving defense evasion.
Detects the execution of 'ntdsutil.exe' with command-line arguments indicating snapshot operations, specifically mounting a snapshot. This activity can be suspicious as 'ntdsutil.exe' is a legitimate Active Directory diagnostic tool that can be abused by adversaries to extract the NTDS.dit file, which contains sensitive credential information.
This rule detects the execution of 'odbcconf.exe' with the 'INSTALLDRIVER' action where the driver specified in the command line does not have a '.dll' extension. This behavior is often indicative of defense evasion, as adversaries may abuse odbcconf.exe to execute arbitrary code or bypass application control by installing non-DLL files as drivers.
Detects the execution of 'odbcconf.exe' where the DLL being registered is located in a potentially suspicious directory. Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads, often placing the DLL in common temporary or public user directories to evade detection or bypass application control.
Page 543 of 680