SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,620 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of 'chcp.com' to switch the system's active code page to a less common or potentially suspicious language, which could be used for defense evasion or to support specific malware functionalities.
This rule detects the creation of a symbolic link (symlink) to a Volume Shadow Copy using the 'mklink' command-line utility. Adversaries often create symlinks to shadow copies to access and exfiltrate sensitive data, such as credential hashes from the Security Account Manager (SAM) database or the Active Directory database (NTDS.dit), without directly interacting with the live system files. This technique is commonly used as part of credential dumping activities.
This rule detects attempts to evade antivirus/EDR detection by piping the content of ntdll.dll to another file or a named pipe. This technique, as demonstrated in the 'NtdllPipe' proof-of-concept, involves using the 'type' command to read the contents of 'ntdll.dll' and redirecting its output, often to a named pipe, to bypass security controls that might monitor direct file access or execution of ntdll.dll.
Detects the creation of potentially suspicious child processes by a ClickOnce application. Adversaries may abuse ClickOnce, a Microsoft deployment technology, to execute malicious code or binaries from a trusted source. This rule specifically looks for common Windows utilities and scripting engines being launched as child processes of a ClickOnce application, which could indicate an attempt to bypass security controls or execute further malicious actions.
Detects the use of dtrace.exe to perform a kernel dump on Windows systems. This activity is suspicious as dtrace.exe is a legitimate debugging tool that can be abused for system information discovery or credential access by dumping kernel memory.
Detects the execution of 'GfxDownloadWrapper.exe' with a URL as a command-line argument, indicating an attempt to download a file. This utility is part of Intel Graphics Command Center and can be abused for ingress tool transfer.
Detects suspicious command lines commonly used by Covenant C2 framework launchers, specifically looking for PowerShell execution with hidden window styles and encoded commands, or specific Covenant-related strings like 'GruntHTTP'.
Detects the execution of tools from SecurityXploded, specifically focusing on 'PasswordDump.exe'. These tools are often used for credential dumping, which involves extracting credentials from various password stores on a system.
Detects the execution of SharpChisel, a .NET port of the Chisel tunneling tool, by monitoring process creation events for the executable name or product metadata. This tool can be used by adversaries to establish internal proxies for command and control traffic.
This rule detects the execution of a SILENTTRINITY stager by looking for the string 'st2stager' within the 'Description' field of process creation events. This string is typically found in the PE metadata of the stager executable, indicating its use.
Page 551 of 680