SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,613 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of 'MSBuild.exe' when its parent process is not one of the commonly associated legitimate processes such as 'devenv.exe', 'cmd.exe', 'msbuild.exe' itself, 'python.exe', 'explorer.exe', or 'nuget.exe'. This behavior can indicate an adversary abusing MSBuild for code execution or defense evasion.
This rule detects the execution of JavaScript code using 'mshta.exe'. Mshta.exe is a legitimate Windows utility that can be abused by adversaries to proxy execution of malicious .hta files and JavaScript or VBScript, often to bypass application control solutions or browser security settings. The rule specifically looks for 'mshta.exe' as the image or original filename and the presence of 'javascript' in the command line arguments.
This rule detects suspicious execution patterns of mshta.exe, a Microsoft HTML Application host. It specifically looks for mshta.exe being spawned by common scripting or system utilities (cmd.exe, powershell.exe, cscript.exe, wscript.exe, regsvr32.exe, rundll32.exe) or when mshta.exe is executed from suspicious directories like AppData, ProgramData, Users\Public, or Windows\Temp. The rule also flags executions involving .htm or .hta files in the command line, while filtering out legitimate executions from System32 or SysWOW64 directories.
Detects the usage of Microsoft Publisher (MSPUB.exe) to download arbitrary files from remote locations (FTP, HTTP, HTTPS). This technique can be abused by adversaries to bypass application control and execute malicious content.
Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE. This rule identifies attempts to enumerate local or domain groups and accounts, specifically looking for commands that list members of sensitive groups like 'domain admins' or 'enterprise admins', or general account information. It filters out commands that are used to add users or groups to reduce false positives. The rule also includes checks for common administrative group names in multiple languages.
Detects the creation of local user accounts using the `net.exe` or `net1.exe` command-line utility with the `expires:never` option, which indicates that the account password will not expire. This is a common technique used by adversaries to establish persistent access.
Detects the addition of a new rule to the Windows firewall using the 'netsh.exe' command-line utility. This activity can indicate an adversary attempting to bypass network controls for C2 communications, lateral movement, or data exfiltration.
This rule detects the execution of the `netsh.exe` utility to configure a port forwarding rule specifically for RDP (port 3389). This technique can be used by adversaries to bypass network restrictions and establish RDP tunnels for lateral movement or command and control.
Detects a suspicious PowerShell download cradle that leverages nslookup to extract payloads from DNS TXT records. This technique is often used for defense evasion by adversaries to retrieve malicious code or data over DNS.
This rule detects the execution of 'odbcconf.exe' with the 'REGSVR' flag to register a new DLL. This technique is often abused by attackers to install and run malicious DLLs, similar to how 'regsvr32.exe' is used. The detection specifically looks for the 'odbcconf.exe' image and command-line arguments containing both 'REGSVR ' and '.dll'.
Page 565 of 680