SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,474 copies16 likes159,599 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects execution from an Alternate Data Stream (ADS) using various Windows utilities. Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. The rule specifically looks for command-line patterns indicative of reading from an ADS (e.g., 'txt:') combined with common tools like 'type', 'makecab', 'reg', 'regedit', or 'esentutl' that can interact with or extract data from streams.
Detects potential command-line obfuscation techniques using escape characters, specifically looking for 'h^t^t^p' or 'h"t"t"p' patterns in process command lines. This method is often used by adversaries to evade detection by security tools that might be looking for cleartext indicators like URLs.
This rule detects the execution of arbitrary shell commands via the '.SettingContent-ms' file type. These files, introduced in Windows 10, are XML-based shortcuts to Windows settings pages. Adversaries can manipulate these files to execute malicious commands, bypassing typical execution controls. The rule specifically looks for process creation events where the command line contains '.SettingContent-ms' and excludes legitimate calls to 'immersivecontrolpanel'.
Detects the use of Windows 8.3 short names in process images, which can be leveraged by adversaries as a defense evasion technique to bypass image-based detections. This rule specifically looks for common executable and script file extensions preceded by '~1' or '~2' in the Image path.
Detects the execution of script interpreters (cscript.exe, mshta.exe, wscript.exe) with suspicious command-line flags or from temporary folders or folders accessible by environment variables, which is a common technique used by adversaries for execution and persistence.
This rule detects the execution of LiveKD, a Sysinternals tool, based on its executable name or original filename metadata. LiveKD allows users to examine a live system's kernel memory, which can be abused by attackers for memory dumping activities, particularly for credential extraction.
Detects suspicious execution of 'sysprep.exe' where the command line includes a path within the 'AppData' folder. This behavior has been observed in malware like Trojan Syndicasec, as detailed in Symantec's Thrip report.
Detects the creation of taskmgr.exe process running under the LOCAL_SYSTEM account. This is an unusual and potentially malicious activity, as task manager typically runs under the user's context. This could indicate an attempt to elevate privileges or execute code with SYSTEM privileges.
This rule detects the creation of new processes where the parent process is `taskmgr.exe`. This activity could indicate an attempt to bypass User Account Control (UAC) by leveraging the Windows Task Manager, which is often auto-elevated. The rule filters out common legitimate processes that `taskmgr.exe` might launch, such as `mmc.exe`, `resmon.exe`, and `Taskmgr.exe` itself, to reduce false positives.
This rule detects the execution of the 'TpmVscMgr.exe' utility with the 'create' command-line argument, indicating the creation of a new virtual smart card. This activity can be legitimate for system administration but could also be leveraged by adversaries for persistence or to bypass authentication mechanisms.
Page 585 of 680