SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,479 copies16 likes159,606 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of 'clip.exe' to copy data to the clipboard. Adversaries may use this utility to collect sensitive information that users have copied within or between applications.
This rule detects the use of the built-in Windows 'copy' command via 'cmd.exe' to transfer files with '.dmp', '.dump', or '.hdmp' extensions from a remote network share (indicated by '\\') to a local system. This activity is often associated with credential dumping techniques where memory dumps (e.g., LSASS process memory dumps) containing sensitive information are exfiltrated or staged.
Detects the execution of the 'del' or 'erase' command-line utilities with wildcard expressions to delete files. This behavior is often observed in malware attempting to remove traces of infection or delete evidence from compromised systems. The rule specifically looks for common executable file extensions like .dll, .exe, .js, and .au3 being targeted by these deletion commands.
Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content from it. This technique has been observed in malicious LNK files, often used for initial access or execution of payloads from remote shares.
Detects the execution of the built-in 'copy' command targeting a Volume Shadow Copy. This technique is often used by adversaries to exfiltrate sensitive files, such as registry hives, that are actively in use and locked by the operating system. By copying from a shadow copy, adversaries can bypass file locks and access system-critical data.
This rule detects the execution of `Cmdl32.exe` with the `/vpn` and `/lan` flags. Attackers can abuse this legitimate Windows utility to download arbitrary files by providing a malicious configuration file. The rule advises inspecting the location and content of the file passed as an argument to determine if it is suspicious.
Detects the execution of "curl.exe" with the "file:///" protocol handler in the command line, which can be used to read local files. This technique can be leveraged by adversaries to exfiltrate or discover sensitive information from a compromised system.
Detects the execution of 'curl.exe' with the '--insecure' flag or its shorthand '-k'. This flag tells curl to proceed with insecure SSL connections and transfers, which can be used by adversaries to bypass certificate validation when communicating with command and control servers or exfiltrating data, especially if they are using self-signed certificates or have intercepted traffic.
This rule detects when 'DefaultPack.exe' launches any child process. 'DefaultPack.exe' is a legitimate Microsoft binary that can be abused by adversaries to proxy execution of other programs, often for defense evasion. The rule aims to identify suspicious activity where this binary is used to launch unexpected or malicious child processes.
Detects the use of the built-in Windows utility `desktopimgdownldr.exe` to download remote files. This utility can be abused by adversaries as an alternative method for ingress tool transfer, similar to `certutil.exe`.
Page 578 of 680