SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,479 copies16 likes159,606 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt by adversaries to bypass parent/child relationship detection or application whitelisting rules by using Diskshadow.exe to proxy execution of other binaries like certutil.exe, powershell.exe, or rundll32.exe. This technique is often used for defense evasion and can be part of credential access or data exfiltration attempts.
Detects the execution of "dotnet-dump" with the "collect" flag, which can indicate potential process dumping of critical processes like LSASS. This tool is part of the .NET Core diagnostics and can be legitimately used for debugging, but its use to collect memory dumps of sensitive processes could be malicious.
This rule detects attempts to bypass Windows Defender by renaming a legitimate tool, specifically `procdump`, to `dump64.exe` and placing it within a Microsoft Visual Studio installation directory. This technique is often used to dump LSASS memory for credential access.
This rule detects the execution of 'format.com' with a command-line argument specifying a file system type that is not commonly used. The intent is to identify potential defense evasion activities where 'format.com' might be leveraged to load malicious DLL files or other programs by manipulating its file system handling capabilities. The rule specifically filters out common file system types like exFAT, FAT, NTFS, ReFS, and UDF, flagging any other '/fs:' argument as suspicious.
Detects the execution of arbitrary binaries or commands by leveraging the Notepad++ updater (gup.exe). This technique can be used by adversaries to bypass application whitelisting or execute malicious code under the guise of a legitimate process.
This rule detects common flag combinations used by CrackMapExec, a post-exploitation tool, to identify its execution even if the binary name has been changed. It looks for specific command-line arguments related to local authentication, hash-based authentication, and module usage for SMB and MSSQL protocols.
Detects the execution of Inveigh, a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool, by looking for its executable name, original file name, description, or specific command-line arguments indicative of its spoofing/sniffing functionality.
This rule detects the execution of PowerShell commands via `cmd.exe` where the PowerShell script is passed through standard input (STDIN) and includes obfuscation techniques. Specifically, it looks for command lines where `cmd.exe` is used with `/c` or `/r` to pipe output to `powershell.exe`, and the PowerShell command itself contains either `${input}` or `noexit` along with `Invoke-Expression` and `DownloadString` patterns, indicative of obfuscated remote code execution.
This rule detects the use of obfuscated environment variables to execute PowerShell commands via `cmd.exe`. Specifically, it looks for command lines where `cmd.exe` is used with `/c` or `/r` to set an environment variable (e.g., `SET VAR=...`) followed by a PowerShell command that leverages string formatting (`(?:{\d}){1,}\\"\s+?\-f(?:.*\)){1,}.*\"`) to reconstruct and execute code. This technique is often employed by adversaries to evade detection by security tools that might monitor for direct PowerShell execution or specific command-line patterns.
Detects the execution of SharpEvtMute, a hack tool designed to tamper with Windows event logs. The rule identifies the tool by its executable name, description, or specific command-line arguments used to filter or encode event log manipulation commands.
Page 579 of 680