SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,614 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of "odbcconf.exe" with the "REGSVR" action where the DLL specified in the command line does not contain a ".dll" extension. This technique is often used by adversaries to evade defenses by registering malicious DLLs without the typical file extension.
This rule detects the execution of any program from the Outlook temporary files folder, which is often used by adversaries to drop and execute malicious payloads received via email. This activity is highly suspicious as legitimate applications typically do not execute from this location.
This rule detects the execution of the Perl interpreter using the `-e` or `-E` flags. These flags allow for inline execution of Perl code directly from the command line, which can be leveraged by adversaries to launch reverse shells, execute arbitrary commands, or run malicious scripts without needing to write a Perl file to disk. This technique is often used in post-exploitation scenarios for stealthy command execution.
Detects the execution of the PHP interpreter using the "-r" flag, which allows for inline execution of PHP code. This method can be leveraged by adversaries to execute arbitrary PHP code, potentially for launching reverse shells or other malicious activities.
Detects potential DLL sideloading using the Microsoft Office Winword process. This rule specifically looks for the execution of 'WINWORD.exe' with the command-line arguments '/l' and a '.dll' file, which is a known method for arbitrary DLL loading.
Detects the use of PowerShell's 'Import-Module' cmdlet to load the 'Microsoft.ActiveDirectory.Management.dll'. This DLL is part of the Active Directory module and is frequently used by attackers for Active Directory enumeration, especially in environments where RSAT (Remote Server Administration Tools) might not be installed or administrative privileges are not initially present.
Detects attempts to capture audio using PowerShell cmdlets, specifically looking for commands related to the 'WindowsAudioDevice-Powershell-Cmdlet' module or similar audio device manipulation cmdlets. This activity could indicate an adversary attempting to record sensitive conversations or gather information from the compromised system's environment.
This rule detects the execution of PowerShell commands that utilize base64 encoded 'IEX' (Invoke-Expression) cmdlets. Adversaries often encode malicious PowerShell scripts in base64 to evade detection and obfuscate their intentions. The rule specifically looks for patterns indicative of base64 encoded 'IEX' calls, including variations with 'New-Object' and different casing, as well as UTF-16 LE encoded versions of common 'IEX' patterns.
Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process". This technique can be used to bypass application control and execute malicious code.
Detects the creation of a new Windows service using PowerShell cmdlets, specifically looking for 'New-Service' and '-BinaryPathName' in the command line. This activity can be indicative of persistence mechanisms or privilege escalation attempts by adversaries.
Page 566 of 680