SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,593 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of 'mshta.exe' with command-line arguments containing URL schemes like 'http://', 'https://', or 'ftp://'. This behavior is indicative of an attacker attempting to execute a remotely hosted HTML Application (HTA) file, which can be used for malicious purposes such as code execution or bypassing security controls. Attackers often leverage mshta.exe as a living-off-the-land binary (LOLBIN) to execute scripts or download additional payloads from remote servers.
Detects a potential LethalHTA technique where 'mshta.exe' is spawned by an 'svchost.exe' process. This parent-child relationship is unusual and can indicate the abuse of mshta.exe for code execution, often bypassing application controls.
This rule detects the execution of 'MSOHTMED.exe' when its command line contains URL indicators such as 'ftp://', 'http://', or 'https://'. MSOHTMED.exe is a legitimate Microsoft Office component (HTML Editor) that can be abused to download arbitrary files from the internet, acting as a living-off-the-land binary (LOLBIN). This behavior can be used by adversaries for defense evasion and execution of malicious content.
This rule detects suspicious execution of PowerShell or Command Prompt (cmd.exe) processes where the parent process is MsiExec.exe and the command line contains '-Embedding'. This behavior is often abused by adversaries to proxy the execution of malicious payloads, leveraging msiexec.exe as a trusted binary to bypass application controls.
Detects when an internet-hosted WebDAV share is mounted using the `net.exe` or `net1.exe` utility. This activity can be indicative of an adversary attempting to establish remote access or exfiltrate data by mounting a remote share.
Detects when a network share is mounted using the "net.exe" or "net1.exe" utility with the 'use' command, indicating potential lateral movement or data access activity.
Detects the usage of the PowerShell '::FromBase64String' cmdlet within a process command line, specifically looking for both direct string and UTF-16 LE encoded variations. This technique is commonly used by adversaries to deobfuscate or decode base64 encoded strings, often containing malicious payloads, within PowerShell scripts.
Detects suspicious PowerShell code that is UTF16 and base64 encoded, often used in command lines for obfuscation. The rule specifically looks for patterns indicative of obfuscated PowerShell, such as '-bxor 0x', '.Invoke() |', and format string patterns like '{1}{0}" -f' or '{0}{3}" -f' in their encoded forms.
Detects base64 encoded PowerShell commands that use 'Add-MpPreference' or 'Set-MpPreference' cmdlets to modify or tamper with Windows Defender Antivirus settings. This is a common technique used by adversaries to disable or reduce the effectiveness of endpoint security solutions.
This rule detects the execution of PowerShell scripts where the script content is provided via a redirected input stream. This technique is often used by adversaries to execute malicious PowerShell code without writing it to a file, which can help evade detection. The rule specifically looks for PowerShell or pwsh executables being run with a command line containing '- <', which signifies input stream redirection.
Page 592 of 680