SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,619 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of NirCmd, a legitimate command-line utility, when used with specific command-line arguments that indicate execution of other commands or scripts. This could be indicative of an adversary using NirCmd for execution, potentially to hide windows or run commands with specific privileges.
Detects the execution of WebBrowserPassView.exe, a password recovery tool that reveals passwords stored by various web browsers including Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera. This tool is often used by adversaries to extract credentials from compromised systems.
This rule detects attempts to enumerate credentials stored in the Windows Registry using the `reg.exe` utility. Specifically, it looks for `reg.exe` commands that query for string values (`/t REG_SZ`) recursively (`/s`) within the HKLM (Local Machine) or HKCU (Current User) hives, or specifically targets the PuTTY sessions key in HKCU. This activity is indicative of an adversary searching for insecurely stored credentials that can be used for further access.
Detects potentially suspicious execution of the Regasm or Regsvcs utilities when they are used with command-line arguments containing uncommon file extensions. This behavior can indicate an attempt to bypass application control or execute malicious code through these trusted Windows utilities, often associated with defense evasion techniques.
Detects when 'DllRegisterServer' is called in the command line of a process that is not 'rundll32.exe'. This behavior is indicative of an adversary renaming the 'rundll32' utility to evade detection, while still leveraging its functionality to execute DLLs.
This rule detects the use of the 'sc.exe' utility to modify service DACLs (Discretionary Access Control Lists) by adding specific permissions ('DCLCWPDTSD'). This technique is often used by threat actors to hide services, making them unremovable and persistent, thereby achieving defense evasion, persistence, and privilege escalation.
This rule detects command-line activities indicative of the uninstallation of Raccine, a ransomware protection tool. It specifically looks for combinations of commands used to terminate Raccine processes, delete its registry entries, and remove its scheduled tasks. The detection logic covers `taskkill` commands targeting `RaccineSettings.exe`, `reg.exe delete` commands referencing "Raccine Tray", and `schtasks /DELETE` commands for "Raccine Rules Updater".
This rule detects executable files created in the Downloads folder that lack common file metadata fields such as FileVersion, Description, Product, or Company. This characteristic is often observed in executables generated by tools like py2exe, which can be used by adversaries to package Python scripts into standalone executables, potentially for malicious purposes. The rule specifically looks for the absence of these fields (indicated by a '?' in the rule logic) in conjunction with the file being located in a user's Downloads directory.
Detects the execution of a process from a directory that is typically not used for legitimate executable files. Adversaries often place their malicious executables in unusual or less-monitored folders to evade detection and blend in with normal system activity. This rule identifies process creations originating from specific suspicious paths like Perflogs, various Users subdirectories, Windows system subdirectories (addins, debug, Fonts, Help, IME, Media, repair, security, Tasks), Recycle Bin, and other less common locations.
This rule detects the creation of processes where the command line contains specific Unicode characters that are visually identical (homoglyphs) to ASCII letter characters. Adversaries use homoglyphs as an obfuscation and masquerading technique to make malicious commands or file names appear legitimate, thereby evading detection and tricking users. The rule specifically targets "perfect" homoglyphs that are indistinguishable from their ASCII counterparts.
Page 555 of 680