SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,479 copies16 likes159,603 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the use of WinZip (winzip.exe or winzip64.exe) to compress and password-protect data. This activity is often associated with adversaries preparing data for exfiltration, as it allows them to package and secure collected information. The rule specifically looks for command-line arguments indicating the use of WinZip along with a password option and common archiving flags.
Detects the execution of "wmic" with the "group" flag to discover local system groups and their members. This activity can indicate an adversary attempting to map the environment for privilege escalation opportunities.
Detects calls to the "terminate" function via wmic.exe in order to kill an application. This activity can be used by adversaries to hinder system recovery or disrupt services.
Detects the removal or uninstallation of an application via "Wmic.EXE" using the 'call uninstall' command line arguments. This activity can be indicative of an adversary attempting to remove security software or other applications to hinder defensive capabilities or clean up traces.
Detects Wscript or Cscript executing a file with an uncommon (i.e., non-script) extension such as .csv, .dat, .doc, .gif, .jpeg, .jpg, .png, .ppt, .txt, .xls, or .xml. This technique can be used by adversaries to bypass application control or obscure malicious script execution.
Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution of other commands or binaries. Adversaries may abuse this legitimate Windows binary to bypass defenses and execute malicious code. The rule specifically looks for wuauclt.exe being executed with command-line arguments that indicate proxy execution, while filtering out common legitimate uses of the binary related to Windows Update deployment.
Detects the execution of Microsoft Connection Manager Profile Installer (CMSTP.exe) by monitoring registry events where 'cmmgr32.exe' is the target object. This activity is often associated with defense evasion and execution techniques, as CMSTP can be abused to proxy execution of malicious code, bypass UAC, or load DLLs/COM scriptlets.
This rule detects attempts to hijack the Antimalware Scan Interface (AMSI) COM server by modifying a specific registry key. Adversaries can change the default value of the `InProcServer32` key for the AMSI CLSID (`{fdb00e52-a214-4aa1-8fba-4357bb0072ec}`) to point to a non-existent COM server. This action prevents AMSI from loading its COM component, effectively disabling its scanning functionalities and rendering it useless for malware detection.
This rule detects attempts to bypass User Account Control (UAC) by modifying the registry to leverage the DelegateExecute verb. Specifically, it looks for modifications to registry keys ending with '\open\command\DelegateExecute' where the 'Details' field is empty, which is indicative of a fileless UAC bypass technique.
Detects the abuse of custom file open handlers by modifying registry keys to execute PowerShell commands. This technique can be used for persistence or defense evasion by adversaries to run arbitrary code when a specific file type is opened.
Page 587 of 680