SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,593 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of PowerShell scripts from user-specific AppData directories (Local or Roaming). This behavior is often indicative of malware or adversary activity attempting to evade detection by running scripts from less common or user-writable locations, rather than standard system paths.
This rule detects the execution of Symantec CleanWipe, a utility designed to remove Symantec antivirus products. Adversaries may use such tools to disable security software as part of their defense evasion tactics. The rule identifies CleanWipe by specific executable names and command-line arguments associated with its uninstallation functions.
Detects the execution of the RunXCmd tool when it attempts to run commands with elevated privileges, specifically using the 'System' or 'TrustedInstaller' accounts. This tool is often used for privilege escalation.
Detects the execution of rundll32 where the DLL being called is stored within an Alternate Data Stream (ADS). This technique can be used by adversaries to hide malicious code.
This rule detects the execution of the Ruby interpreter (ruby.exe) with the "-e" flag. This flag allows for inline execution of Ruby code directly from the command line, which can be leveraged by adversaries to execute arbitrary commands, launch reverse shells, or run malicious Ruby scripts without needing to save them to a file. This technique is often used in post-exploitation scenarios or for initial access.
Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...). This technique can be used for defense evasion and execution of malicious code.
Detects modifications to Windows service paths using the 'sc.exe' utility to point to suspicious executables or common adversary-used paths. This activity can indicate an attempt to establish persistence or escalate privileges by altering how a service executes.
Detects the use of the WMI class "Win32_NTEventlogFile" with methods that can be used to manipulate event logs, such as deleting, backing up, or changing permissions. This activity, especially when originating from a PowerShell script, can be indicative of an adversary attempting to evade detection or inhibit system recovery.
This rule detects the use of Windows 8.3 short names in command-line arguments. Adversaries may use this technique to obfuscate their commands and evade detection by security tools that rely on full file paths or specific keywords. The rule specifically looks for patterns like '~1.exe', '~1.bat', etc., which are indicative of short name usage. This can be a defense evasion technique.
This rule detects attempts to discover private key files using command-line tools such as `cmd.exe`, `powershell.exe`, or `findstr.exe`. It specifically looks for commands that include common private key file extensions like .key, .pgp, .gpg, .ppk, .p12, .pem, .pfx, .cer, .p7b, and .asc. This activity is indicative of an adversary searching for insecurely stored credentials on a compromised system.
Page 593 of 680