SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,618 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the usage of "findstr" with the argument "385201", which is the default driver altitude for Sysinternals Sysmon. This activity could indicate an adversary attempting to discover if Sysmon is installed on a system, even if the service name has been changed.
This rule detects the execution of 'fsutil.exe' with the 'drives' command-line argument. This command is used to enumerate connected drives on a Windows system. Adversaries, such as Turla, have been observed using this technique for discovery purposes to gain information about the system's environment.
This rule detects the execution of `rundll32.exe` with a DLL containing the exported function `StartNodeRelay`. This specific function is associated with F-Secure C3, a command and control framework. Detection indicates potential use of this tool for malicious purposes, likely for defense evasion and establishing C2 communications.
Detects command-line arguments that are characteristic of Cobalt Strike modules or commands, which may indicate an operator error where these commands are accidentally typed into a command prompt instead of the Cobalt Strike console. This rule specifically looks for common 'Invoke-' PowerShell module names and other Cobalt Strike related keywords executed via 'cmd.exe'.
This rule detects the execution of rundll32.exe with command-line arguments indicative of Cobalt Strike's StartW function being used to load DLLs. Specifically, it looks for 'rundll32.exe' or 'rundll32 ' in the command line, along with a '.dll' file and either ' StartW' or ',StartW' as the ending argument. This behavior is commonly associated with Cobalt Strike for defense evasion and execution of malicious payloads.
Detects the execution of Htran or Htran-like tools such as NATBypass, identified by specific executable names or command-line arguments. These tools are commonly used for proxying network connections to obscure the origin of malicious traffic.
This rule detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. It specifically looks for command-line arguments that use variable manipulation (e.g., $PSHome, $ShellId, $env:Public, $env:ComSpec) and string concatenation to construct and execute PowerShell commands, which is a common technique for defense evasion.
Detects obfuscated PowerShell execution leveraging MSHTA. The rule specifically looks for command-line arguments that indicate the use of 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)', which are common patterns in MSHTA-based PowerShell obfuscation.
Detects obfuscated PowerShell commands that leverage `clip.exe` to retrieve content from the clipboard for execution. This technique is often used to evade detection by hiding malicious scripts in the clipboard until runtime.
Detects the usage of 'pypykatz' to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored. The rule specifically looks for the execution of 'pypykatz.exe' or 'python.exe' with command-line arguments indicating 'live' and 'registry' access, which are common parameters for dumping credentials from the live registry hive.
Page 562 of 680