SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,479 copies16 likes159,603 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of Windows Defender's MpCmdRun.exe utility to download files from a specified URL. This technique can be abused by adversaries for ingress tool transfer or to bypass security controls by using a legitimate, signed Microsoft binary.
Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command line, which could indicate a suspicious activity. This pattern is often observed in scripts attempting to execute commands via Windows Script Host (WSH) objects.
MsiExec Web Install
Sigma
Detects suspicious execution of msiexec.exe with web addresses as parameters, which can be indicative of an adversary attempting to download and execute malicious MSI packages or DLLs directly from a remote source. This technique is often used for defense evasion and ingress tool transfer.
Detects the execution of msiexec.exe from an uncommon directory, which can indicate an attempt to masquerade malicious activity by naming a malicious executable 'msiexec.exe' and placing it outside of its standard legitimate paths. This technique is often used for defense evasion.
Detects the usage of the "net.exe" or "net1.exe" command-line utility to start a Windows service using the "start" flag. This activity can be indicative of an adversary executing a service, potentially for persistence or privilege escalation.
Detects the stopping of a Windows service using the 'net.exe' or 'net1.exe' utility with the 'stop' command-line argument. This rule specifically looks for the execution of these utilities with the intent to terminate a service.
Detects the creation of new local user accounts using the 'net.exe' or 'net1.exe' command-line utility with the 'user add' arguments. This activity can be indicative of an adversary establishing persistence or creating accounts for lateral movement.
Detects attempts to enumerate file shares, printer shares, and sessions using the 'net.exe' or 'net1.exe' utility with the 'view' flag. This activity is often performed by adversaries for remote system discovery.
This rule detects the use of 'netsh.exe' to modify Microsoft Defender Firewall rules. Specifically, it looks for command-line arguments that indicate the setting of a new firewall rule with 'group=' and 'enable=Yes', which could be used by adversaries to bypass network controls.
This rule detects PowerShell command lines that exhibit characteristics of obfuscation by looking for repeated special characters such as '+', '{', '^', and '`'. These patterns are commonly used by adversaries to evade detection by making the command less readable or to bypass signature-based defenses. The rule specifically targets PowerShell (powershell.exe) and PowerShell Core (pwsh.exe) processes.
Page 581 of 680