SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,623 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation of any child process by 'odbcconf.exe'. Typically, 'odbcconf.exe' should not spawn child processes. Adversaries often abuse 'odbcconf.exe' to proxy execution of malicious payloads, such as DLLs, to bypass application control solutions. This behavior is indicative of potential defense evasion tactics.
Detects an executable in a user's directory that is spawned by a Microsoft Office application (Word, Excel, PowerPoint, Publisher, Visio, Access, Equation Editor). This behavior is often associated with malicious documents attempting to execute payloads.
This rule detects attempts to bypass Antimalware Scan Interface (AMSI) functionalities by using specific strings or NULL bits in command-line arguments. Adversaries often employ such techniques to obfuscate malicious scripts or commands, preventing security products from detecting and blocking them. The rule specifically looks for patterns like "if(0){{{0}}}' -f $(0 -as [char]) +" and "#<NULL>" in the command line, which are known indicators of AMSI bypass attempts.
This rule detects command-line executions that include specific function calls, 'LoadAssemblyFromPath' or 'LoadAssemblyFromNS', which are associated with the 'CL_LoadAssembly.ps1' script. This script can be leveraged to load .NET assemblies, potentially bypassing AppLocker controls and executing arbitrary code. The detection focuses on instances where these function calls are made directly via command-line arguments, such as through PowerShell's '-Command' or '-ScriptBlock' flags.
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file. This activity is often seen in reconnaissance phases where attackers map out the network environment.
Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features such as IEHarden, Data Execution Prevention (DEP), and the First Run Customize wizard.
This rule detects the execution of PowerShell or PowerShell Core (pwsh.exe) with command-line arguments indicative of base64 encoded commands. Adversaries often use base64 encoding to obfuscate malicious PowerShell scripts, making them harder to detect by simple string matching. The rule specifically looks for common encoding flags such as '-e', '-en', '-enc', '-enco', or '-ec'. It filters out legitimate uses of '-Encoding' and activity from Azure Guest Configuration worker processes to reduce false positives.
Detects calls to PowerShell cmdlets used to export certificates from the local certificate store. Threat actors have been observed abusing this technique to steal private keys from compromised machines, which can then be used for authentication or decryption.
Detects the execution of PowerShell where the parent process is suspicious or uncommon. This rule specifically looks for PowerShell being spawned by processes like web servers (tomcat, httpd, nginx, w3wp), database servers (sqlagent, sqlserver, sqlservr), browsers (chrome, firefox, iexplore, microsoftedge, safari, vivaldi, browser.exe, amigo.exe), or other processes not typically expected to launch PowerShell, such as mshta.exe, regsvr32.exe, rundll32.exe, services.exe, jbosssvc.exe, and php-cgi.exe. This pattern can indicate various forms of compromise, including web shell execution, SQL injection leading to command execution, or malicious scripts launched by compromised applications or user interaction.
Detects child processes of 'provlaunch.exe' which might indicate potential abuse to proxy execution. Adversaries may use 'provlaunch.exe', a legitimate Windows binary, to execute arbitrary commands or binaries, bypassing security controls or masquerading malicious activity.
Page 544 of 680