SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,619 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects attempts to tamper with Windows audit policies using an older version of the `auditpol` binary, specifically from the NT resource kit. Adversaries may use this method to disable or remove certain audit policies, or restore a custom policy, thereby impairing detection capabilities by limiting the logging of security-relevant events.
This rule detects the execution of the Microsoft bash launcher (bash.exe) without any command-line flags. This behavior can be indicative of an adversary attempting to bypass security defenses by executing Linux or Windows-based binaries indirectly through bash, potentially leveraging it as a living-off-the-land binary (LOLBAS). The rule specifically looks for bash.exe being run without common flags like '-' or an empty command line, suggesting an attempt to execute a script or command without directly specifying it as an argument.
Detects the use of bitsadmin.exe to download a file from a direct IP address. This technique is often used by adversaries for ingress tool transfer or to establish persistence by downloading malicious payloads directly from an IP address, bypassing typical domain-based filtering or logging.
Detects possible payload obfuscation via the commandline
Detects Windows command lines that miss a space before or after the /c or /k flag when running a command using cmd.exe. This could indicate an attempt at command obfuscation or a typo. The rule specifically looks for patterns like 'cmd.exe/c', '\cmd/c', '"cmd/c', and similar for /k and /r, as well as specific commands like '/cwhoami', '/cpowershell', etc., where the space is missing. It filters out common false positives related to VS Code and specific command line endings.
This rule detects the execution of 'curl.exe' when it is used with the '-H' flag to specify a custom 'User-Agent' string. This behavior can be indicative of an attacker attempting to download or exfiltrate data to a domain that requires a specific User-Agent for access, potentially to bypass security controls or blend in with legitimate traffic. The rule specifically looks for the 'curl.exe' image or original filename and the presence of '-H' followed by 'User-Agent:' in the command line.
Detects the use of "devinit.exe" with specific command-line arguments to download arbitrary MSI packages. This technique can be abused as a Living Off The Land Binary (LOLBIN) to perform malicious downloads on a Windows system.
Detects the execution of Dnx.EXE, which can be abused by attackers to bypass application whitelisting by executing C# code.
Detects the execution of 'dsquery.exe' with command-line arguments indicative of domain trust discovery. This activity is often performed by adversaries to map out the network environment and identify potential lateral movement paths within multi-domain Active Directory environments.
This rule detects the execution of 'driverquery.exe' or 'drvqry.exe' when initiated by specific parent processes or from suspicious directories. The parent processes include scripting engines like cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe. Additionally, the rule flags execution where the parent process image path contains common temporary or user-writable directories such as 'AppData\Local\', 'Users\Public\', or 'Windows\Temp\'. This combination aims to identify reconnaissance activity where an attacker is attempting to enumerate installed drivers on a system, potentially as part of a larger compromise, often associated with malware like Ursnif.
Page 561 of 680