SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,593 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects attempts to unload the Sysmon filter driver using 'fltmc.exe'. This activity is often indicative of an adversary trying to impair defenses and remove forensic evidence by disabling Sysmon's monitoring capabilities.
This rule detects the use of Gpg4win's gpg.exe or gpg2.exe for file decryption. It specifically looks for command-line arguments that include both '-d' (for decrypt) and 'passphrase', indicating an attempt to decrypt a file using a passphrase. This activity can be indicative of malicious actors decrypting sensitive data or malware components.
Detects PowerShell command-line obfuscation techniques specifically associated with 'COMPRESS OBFUSCATION' often used by tools like Invoke-Obfuscation. This method typically involves compressing data and decompressing it in memory using .NET classes like `System.IO.Compression.DeflateStream` and `System.IO.StreamReader` combined with `new-object` and `text.encoding]::ascii`.
Detects obfuscated PowerShell execution via standard input (stdin) in scripts. This technique is often used by adversaries to evade detection by security tools that might inspect command-line arguments.
This rule detects the execution of 'hxtsr.exe' from an unexpected file path. HxTsr.exe is a legitimate Microsoft Outlook Communications component typically found within a hidden 'WindowsApps' subfolder of 'C:\Program Files'. If 'hxtsr.exe' is executed from any other location, it could indicate malware attempting to masquerade as a legitimate process to evade detection.
This rule detects the execution of 'diantz.exe' with command-line arguments that indicate both a remote file path (identified by '\\') and the creation of a CAB file (identified by '.cab'). This combination suggests that the 'diantz.exe' utility is being used to download a remote file and compress it into a CAB archive on the local machine. This behavior is often associated with adversaries transferring tools or data into a compromised environment.
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Detects potential abuse of the "register_app.vbs" script, which is part of the Windows SDK. This script can register new VSS/VDS Providers as COM+ applications. Attackers may leverage this functionality to install malicious DLLs for persistence and execution.
This rule detects the execution of 'wfc.exe', the Workflow Command-line Compiler. This utility is known to be used for Application Whitelisting (AWL) bypasses and is listed in Microsoft's recommended block rules for applications that can bypass Windows Defender Application Control (WDAC). Detection of this executable could indicate an attempt to bypass security controls or execute unauthorized code.
This rule detects the creation of child processes by 'Mftrace.exe', which is a legitimate Windows utility (Trace log generation tool for Media Foundation Tools). Adversaries can abuse 'Mftrace.exe' to execute arbitrary binaries, effectively bypassing application whitelisting or other security controls by proxying execution through a trusted process. The rule specifically looks for any process that has 'mftrace.exe' as its direct parent.
Page 591 of 680