SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,614 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the use of "ProtocolHandler.exe" to download files from the internet. "ProtocolHandler.exe" is a legitimate Windows binary that can be abused to download files, often placing them in the Internet Explorer cache folder. The detection specifically looks for the execution of "ProtocolHandler.exe" combined with command-line arguments containing common internet protocols like 'ftp://', 'http://', or 'https://'. This behavior is indicative of System Binary Proxy Execution (T1218) where a trusted binary is used to perform malicious actions, potentially bypassing security controls.
Detects suspicious child processes spawned by "provlaunch.exe". This behavior indicates potential abuse of "provlaunch.exe" for proxy execution, where a legitimate signed binary is used to execute other malicious or suspicious binaries, often for defense evasion. The rule specifically looks for common Windows utilities or executables in suspicious temporary or user-writable directories being launched as children.
Detects the execution of 'ditsnap.exe', a tool used to inspect the Active Directory database (ntds.dit). This tool can be used by adversaries to dump credentials from a domain controller.
Detects the execution of the reconnaissance tool Seatbelt. This rule identifies Seatbelt activity based on its executable name, original file name, description, and specific command-line arguments used for various discovery tasks, including DpapiMasterKeys, InterestingProcesses, InterestingFiles, CertificateThumbprints, Chromium data, CloudCredentials, CredEnum, CredGuard, FirefoxHistory, and ProcessCreationEvents. It also covers group-based commands like 'misc', 'remote', 'chromium', 'slack', 'system', 'user', and 'all', as well as output to a file.
Detects the execution of Python with command-line arguments that indicate an attempt to spawn a pseudo-terminal (TTY). This technique is often used by attackers to gain an interactive shell, especially in compromised environments where direct shell access might be restricted. The rule specifically looks for Python executable names combined with command-line patterns like 'import pty', '.spawn(', or 'from pty import spawn'.
This rule detects the use of 'rar.exe' to add files to an archive. Adversaries often compress collected data, such as sensitive documents, before exfiltration to make it more portable and reduce the amount of data transferred over the network. The detection specifically looks for the execution of 'rar.exe' with the 'a' command-line argument, which is used for adding files to an archive.
Detects the execution of the 'reg.exe' utility with the 'delete' flag targeting registry keys associated with Windows services. This activity is often performed by attackers to remove or disable security software services as a defense evasion tactic.
Detects the execution of 'reg.exe' to modify registry keys associated with various Windows security services, attempting to disable them. This includes services like Windows Defender components (MsMpSvc, WinDefend, WdBoot, WdFilter, WdNisDrv, WdNisSvc), SecurityHealthService, AppIDSvc, NisSrv, Sense, UsoSvc, wscsvc, and wuauserv, by setting their 'Start' value to '4' (disabled).
This rule detects suspicious modifications to the Windows Registry related to the 'ms-settings' URI scheme, specifically targeting the 'DelegateExecute' value or the default value of 'HKCU\Software\Classes\ms-settings\Shell\Open\Command'. This technique can be used by adversaries to hijack the execution of applications launched via the 'ms-settings' URI, potentially leading to arbitrary code execution or privilege escalation. The rule also includes a detection for the deletion of the 'ms-settings' key, which could be an attempt to clean up after such an attack.
This rule detects attempts to enumerate installed software versions on a Windows system using the `reg.exe` utility. Specifically, it looks for `reg.exe` commands that query the registry for software version information, often found under `HKEY_LOCAL_MACHINE\Software\` paths and requesting the `svcVersion` value. This activity can be indicative of an adversary trying to identify vulnerable software or understand the system's security posture.
Page 568 of 680