SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,620 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of the `hostname.exe` utility. Adversaries often use this command-line tool to gather information about the compromised system, specifically its hostname, as part of their discovery phase. This activity is typically a precursor to further malicious actions.
This rule detects the execution of 'DeviceCredentialDeployment.exe', a legitimate Windows binary that can be abused to hide processes from view. This technique is often used for defense evasion.
Detects the execution of the built-in Windows script 'gatherNetworkInfo.vbs' via cscript.exe or wscript.exe. This script is designed to gather detailed network information about the target machine, which can be leveraged by adversaries for reconnaissance purposes.
This rule detects the execution of msdeploy.exe with specific command-line arguments that indicate an attempt to execute arbitrary commands. Adversaries may abuse msdeploy.exe, a legitimate Microsoft utility, to proxy execution of malicious content, bypassing security controls that monitor for direct execution of suspicious binaries. The rule specifically looks for the 'verb:sync', '-source:RunCommand', and '-dest:runCommand' arguments in conjunction with msdeploy.exe, which are indicative of this technique.
Detects when OpenWith.exe is used to execute another binary, indicated by the presence of '/c' in the command line. This technique can be used by adversaries to bypass process and/or signature-based defenses by proxying execution with a trusted binary.
Detects the execution of 'OpenConsole.exe' when it is not launched from the legitimate Windows Terminal path. This behavior is often indicative of an adversary attempting to use 'OpenConsole.exe' as a Living Off The Land Binary (LOLBIN) to bypass application whitelisting and execute other binaries.
Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands, specifically looking for the 'script:' argument which can be abused for proxy execution of remote files. This technique is often used for defense evasion.
This rule detects the execution of `SyncAppvPublishingServer.vbs` with a command-line argument containing a semicolon, which is indicative of arbitrary PowerShell code execution. Adversaries can abuse this legitimate VBScript to bypass PowerShell execution restrictions and evade defensive measures by proxying execution through a trusted, signed binary.
Detects the execution of msdt.exe by a suspicious parent process, which is indicative of exploitation techniques such as the 'Follina' vulnerability (CVE-2022-30190). The rule specifically looks for msdt.exe being spawned by common scripting or system utility processes often abused in such attacks.
This rule detects the execution of PowerShell code through the `sqlps.exe` utility, which is part of the Microsoft SQL Server utilities. This method can be used by adversaries to bypass detection mechanisms that rely on PowerShell script block logging, as `sqlps.exe` does not log script blocks.
Page 552 of 680