SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,612 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of 'tapinstall.exe', which is used to install TAP (Tunnel Adapter) drivers. While legitimate for VPN software like OpenVPN, Avast SecureLine VPN, and ProtonVPN, its execution outside of these known contexts could indicate an adversary preparing for data exfiltration using tunneling techniques. TAP drivers create virtual network interfaces, which can be leveraged to establish covert communication channels or bypass network segmentation.
Detects the use of the 'taskkill' command to terminate the 'ccSvcHst.exe' process, which is associated with Symantec Endpoint Protection. This action can disable the antivirus software due to an incorrect implementation of the protected service mechanism, allowing a SYSTEM user to kill the process and shut down the service.
Detects the use of "VMwareToolBoxCmd.exe" with the "script" and "set" flags to configure a script to run when a VM state changes. The rule specifically looks for scripts located in suspicious paths like temporary directories or Windows system directories, which could indicate an attempt at persistence or privilege escalation within a virtualized environment.
Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.
Detects the execution of "WerFault.exe" with the "-pr" command-line flag. This specific command-line argument is used to run files stored in the ReflectDebugger registry key, which can be abused by adversaries to masquerade execution flow and achieve persistence or defense evasion by leveraging a legitimate Windows error reporting process.
Detects the execution of 'whoami.exe' with the '/groups' or '-groups' command-line flag to enumerate group membership for the current user. This activity is often performed by attackers during the discovery phase to understand the privileges of a compromised account.
Detects the execution of 'whoami.exe' with the '/priv' or '-priv' command-line flag. This command is used to display the current user's security privileges and is often executed by adversaries after a successful privilege escalation to understand their new capabilities or during discovery phases.
Detects the execution of WinRAR to compress files with '.dmp', '.dump', or '.hdmp' extensions. This activity could indicate a step in exfiltrating memory dump files or other sensitive dump files.
Detects the execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl files via winrm.vbs and a potentially renamed cscript.exe. This technique is used to bypass Application Whitelisting (AWL) by leveraging legitimate Windows scripts.
This rule detects the creation of a WMI script event consumer by monitoring for the execution of 'scrcons.exe' with 'svchost.exe' as its parent process. This specific process relationship is indicative of WMI persistence mechanisms, where a script event consumer is registered to execute code when certain WMI events occur. Adversaries often leverage WMI event consumers for persistence and privilege escalation.
Page 571 of 680