SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,622 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the installation of a potentially suspicious new shim database using sdbinst.exe where the command line does not contain common, legitimate file extensions or flags. Adversaries may use application shimming for persistence or privilege escalation.
This rule detects the execution of the Windows built-in SoundRecorder.exe application when it is used with the '/FILE' command-line argument. This specific command-line argument indicates that SoundRecorder is being used to capture audio and save it to a file, which is a common technique used by attackers for audio surveillance.
This rule detects the execution of command-line tools like 'dir' or 'findstr' in conjunction with specific file extensions (e.g., .doc, .pdf, .txt) that are commonly associated with sensitive data or credentials. This behavior indicates an attempt at automated collection of data, potentially for exfiltration or further analysis by an adversary. The rule specifically looks for 'dir' commands with '/b' (bare format) and '/s' (subdirectories) flags, or 'findstr' with '/e' (end of line) and '/si' (case-insensitive search for string in files) flags, targeting common document and text file types.
This rule detects potential evasion or obfuscation attempts by identifying command lines that use bogus path traversal. Specifically, it looks for patterns like '\\..\\Windows\\', '\\..\\System32\\', or '\\..\\..\\' within the command line of processes whose image path contains '\\Windows\\'. It also flags command lines containing '.exe\\..\\' which could indicate an attempt to manipulate execution paths. The rule includes filters for known legitimate applications like Google Drive and Citrix that might exhibit similar behavior.
Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations. This technique is often used by adversaries to evade security controls that monitor execution from standard system paths.
Detects the use of the filename 'DumpStack.log' for a process image or in a command line when downloading, which is a known technique to evade Microsoft Defender. Adversaries may rename malicious executables to 'DumpStack.log' to bypass security controls that might ignore or whitelist files with this name, or use it as an output file name for downloads.
Detects the presence of keywords like "lsass" and ".dmp" in the command line, which indicates a potential attempt to dump the LSASS process memory. This technique is commonly used by adversaries to extract credentials.
This rule detects suspicious child processes spawned by parent processes that typically should not have any children, or should only have a very limited set of known child processes. The rule specifically looks for child processes of applications like Minesweeper, Winver, Bitsadmin, Csrss, Certutil, Eventvwr, Calc, and Notepad, while filtering out common legitimate child processes for some of these parents (e.g., WerFault.exe, conhost.exe). This behavior can indicate defense evasion or execution of malicious code from an unexpected parent.
Detects suspicious output redirection to the local administrative share (ADMIN$). This technique is often used by malicious scripts or hack tools to stage or exfiltrate data by writing it to a location accessible via the network, specifically targeting the ADMIN$ share on localhost or 127.0.0.1.
This rule detects the creation of shadow copies using operating system utilities such as PowerShell, WMIC, or VSSAdmin. Adversaries often create shadow copies to access credential material, specifically the NTDS.dit file or SAM database, for offline analysis. The rule looks for specific executable names combined with command-line arguments containing 'shadow' and 'create'.
Page 546 of 680