SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,620 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Msxsl.EXE Execution
Sigma
Detects the execution of the MSXSL utility (msxsl.exe). This utility can be abused by adversaries to execute Extensible Stylesheet Language (XSL) files, potentially bypassing application whitelisting defenses and executing arbitrary code. The rule specifically looks for the execution of 'msxsl.exe'.
This rule detects the use of 'net.exe' or 'net1.exe' with the 'use' command to mount an administrative share (e.g., C$, ADMIN$) on a Windows system. This activity is often associated with lateral movement by adversaries.
This rule detects attempts to discover network connections on a system using the built-in Windows `net.exe` or `net1.exe` utility with the `use` or `sessions` commands. Adversaries often use these commands to map out network resources and active user sessions on compromised systems.
This rule detects the execution of 'net.exe' or 'net1.exe' with a password provided directly in the command line. This is a security risk as it exposes credentials and can be used for lateral movement, persistence, or privilege escalation. The rule specifically looks for the 'use' keyword, a colon followed by an asterisk and a backslash (indicating a password field), and '/USER:* *' to identify password usage in the command line arguments.
Detects the execution of the Windows Defender `OfflineScannerShell.exe` from a non-standard directory. This binary is known to be vulnerable to DLL side-loading, specifically loading `mpclient.dll` from its current working directory. An adversary could place a malicious `mpclient.dll` in a non-standard directory and then execute `OfflineScannerShell.exe` from that directory to achieve arbitrary code execution.
Detects the usage of the "Add-WindowsCapability" PowerShell cmdlet to install Windows capabilities. This rule specifically highlights the installation of "OpenSSH" related capabilities, which could be used for remote access.
Detects the use of the Microsoft signed script "CL_mutexverifiers.ps1" to proxy the execution of additional PowerShell script commands. This technique can be used by adversaries for defense evasion by leveraging a trusted, signed script to execute malicious code.
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file. This activity is often seen in reconnaissance phases where attackers map out the network environment.
This rule detects the usage of the 'ConvertTo-SecureString' cmdlet via the command line. This cmdlet is used to convert plain text into a secure string object, which can then be used to store sensitive information like passwords. While it has legitimate uses, its direct invocation from the command line is uncommon in typical user activity and can indicate suspicious behavior, potentially related to credential manipulation or obfuscation techniques by adversaries.
Detects the use of the PowerShell cmdlet "Enable-WindowsOptionalFeature" to enable potentially suspicious or insecure Windows features. This cmdlet functions similarly to DISM.exe for managing Windows features and packages. The rule specifically looks for the enablement of features like Telnet Server, Internet Explorer (optional), TFTP, SMB1 Protocol, Client-ProjFS, and Windows Subsystem for Linux, which might be enabled by adversaries for various purposes or represent a security risk if not intentionally used.
Page 553 of 680