SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,617 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of specific commands and DLLs associated with the RedMimicry Winnti playbook, an automated breach emulation utility. The rule looks for 'rundll32.exe' or 'cmd.exe' processes executing with command-line arguments containing 'gthread-3.6.dll', '\Windows\Temp\tmp.bat', or 'sigcmm-2.4.dll'. This indicates the use of specific tools and techniques employed by the Winnti threat group, as emulated by RedMimicry.
Detects the execution of the hacktool SafetyKatz, which is used for credential dumping, by identifying its executable name, original file name, or description in process creation events.
Detects the execution of SharpLDAPmonitor, a tool used to monitor the creation, deletion, and changes to LDAP objects. This rule triggers on either the image name 'SharpLDAPmonitor.exe' or its original filename, combined with command-line arguments indicating user, password, and domain controller IP, which are typical for LDAP monitoring activities.
Detects the execution of the SharpImpersonation tool, which is used for manipulating tokens on Windows systems. This can occur remotely via tools like PsExec/WmiExec or interactively. The rule specifically looks for the executable name or command-line arguments indicating token manipulation techniques such as 'CreateProcessAsUserW' or 'ImpersonateLoggedOnUser', often combined with 'user:' and 'binary:' or 'shellcode:' parameters.
This rule detects the execution of ZipExec, a Proof-of-Concept (POC) tool designed to wrap binary-based tools into a password-protected zip file. It specifically looks for command-line arguments indicative of ZipExec's 'run' functionality (extracting and executing a zip file with a password) or 'delete' functionality (deleting the extracted files). The detection relies on specific strings like '/generic:Microsoft_Windows_Shell_ZipFolder:filename=', '.zip', '/pass:', '/user:' for 'run' operations, and '/delete', 'Microsoft_Windows_Shell_ZipFolder:filename=', '.zip' for 'delete' operations.
Detects the creation of a 'gbb.exe' process as a sub-process of 'Hwp.exe' (Hangul Word Processor). This behavior is highly suspicious and often indicative of exploitation attempts targeting vulnerabilities within the HWP application, leading to the execution of malicious payloads.
Detects the use of `icacls.exe` with specific command-line arguments to deny access for everyone (represented by the SID *S-1-1-0*) to a file or directory. This technique is often used by adversaries to hide malicious files by making them inaccessible to users and potentially some security tools.
Detects the use of the "appcmd.exe" utility to create or modify global URL rewrite rules within Internet Information Services (IIS). This activity is suspicious because threat actors have been observed leveraging this method to establish persistence or facilitate access to webshells by redirecting traffic or enabling specific paths.
Detects when a shell process (bash, cmd, or PowerShell) is spawned by a Java executable. This activity can be indicative of exploitation, such as the Log4j vulnerability, where an attacker leverages a Java application to execute arbitrary commands on the underlying system. The rule filters out common CI build agent activities to reduce false positives.
Detects password change for the computer's domain account or host principal via "ksetup.exe", a command-line tool used to configure Kerberos settings.
Page 563 of 680