SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,619 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when a non-Sysinternals tool attempts to set the 'EulaAccepted' registry key for a Sysinternals tool. This behavior is indicative of an adversary attempting to use renamed Sysinternals tools to evade detection, as the 'EulaAccepted' key is typically set by the legitimate Sysinternals tool upon its first execution.
Detects a User Account Control (UAC) bypass technique that exploits the 'iscsicpl.exe' process. This bypass leverages DLL Search Order Hijacking to load a malicious 'iscsiexe.dll' from a user-controlled location (e.g., temporary directory or a modified PATH environment variable) instead of the legitimate system directory. The rule specifically looks for 'iscsicpl.exe' loading 'iscsiexe.dll' from any location other than 'C:\Windows\'.
This rule detects instances where 'rundll32.exe' initiates an outbound network connection to a public IP address. It filters out connections to common local, private, and Microsoft-owned IP ranges, as well as specific legitimate command lines and Azure internal hostnames, to reduce false positives. The rule aims to identify suspicious network activity originating from rundll32.exe, which is often abused by malware for defense evasion and execution.
Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and make network connections. This rule specifically looks for wuauclt.exe making network connections with the '/RunHandlerComServer' command-line argument, while filtering out common internal IP ranges and known Microsoft update server IP ranges to reduce false positives. It also filters out specific command-line patterns related to legitimate Windows Update deployments.
This rule detects the execution of the PowerShell cmdlet 'Get-NetTCPConnection', which adversaries may use to discover network connections on a compromised system. This activity is often part of the discovery phase in an attack chain, where an attacker gathers information about the network environment.
Detects PowerShell scripts that utilize compression and decompression techniques, specifically looking for 'new-object', 'text.encoding]::ascii', 'system.io.compression.deflatestream', 'system.io.streamreader', and 'readtoend' in the payload. This pattern is indicative of obfuscated PowerShell often used by tools like Invoke-Obfuscation to hide malicious code.
Detects obfuscated PowerShell commands that utilize 'clip.exe' to interact with the clipboard, often as part of an obfuscation technique like those used by Invoke-Obfuscation. The rule specifically looks for patterns where 'echo' is piped to 'clip' and then followed by terms related to 'Clipboard' or 'invoke' with potential character obfuscation.
Detects obfuscated PowerShell execution leveraging MSHTA. This technique is often used for defense evasion by adversaries to execute malicious scripts without directly invoking PowerShell. The rule specifically looks for a combination of keywords indicative of this method, including 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)' within the PowerShell module payload.
Detects suspicious PowerShell commands that utilize 'System.Net.WebClient' to download files or strings from the internet. This technique is commonly used by adversaries for ingress tool transfer or to fetch additional malicious payloads.
This rule detects the usage of the 'Add-WindowsCapability' PowerShell cmdlet, specifically looking for attempts to add Windows capabilities. It explicitly targets the addition of 'OpenSSH' related capabilities (both 'OpenSSH.Server' and 'OpenSSH.Client'). This activity could indicate an adversary attempting to install tools for remote access or other malicious purposes.
Page 558 of 680