Rule Library

Sigma Rules

1,398 rules found

3,707Total
3,116Detection
451Emerging
137Hunting
Threat Huntmediumexperimental

FTP Connection Open Attempt Via Winscp CLI

Detects the execution of Winscp with the "-command" and the "open" flags in order to open an FTP connection. Akira ransomware was seen using this technique in order to exfiltrate data.

WindowsProcess Creation
TA0010 · ExfiltrationT1048 · Exfiltration Over Alternative Protocoldetection.threat-hunting
François HubautSun Oct 12windows
Threat Huntmediumexperimental

Winscp Execution From Non Standard Folder

Detects the execution of Winscp from an a non standard folder. This could indicate the execution of Winscp portable.

WindowsProcess Creation
TA0010 · ExfiltrationT1048 · Exfiltration Over Alternative Protocoldetection.threat-hunting
François HubautSun Oct 12windows
Threat Huntlowtest

System Information Discovery Via Wmic.EXE

Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, disk drive names, memory capacity, display resolution, baseboard, BIOS, and GPU driver products/versions.

WindowsProcess Creation
TA0007 · DiscoveryT1082 · System Information Discoverydetection.threat-hunting
Joseliyo SanchezTue Dec 19windows
Threat Huntmediumtest

WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf) by Wscript/Cscript

WindowsProcess Creation
TA0002 · ExecutionT1059.005 · Visual BasicT1059.007 · JavaScriptdetection.threat-hunting
Michael HaagWed Jan 16windows
Threat Huntmediumtest

Arbitrary Command Execution Using WSL

Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.

WindowsProcess Creation
TA0002 · ExecutionTA0005 · Defense EvasionT1218 · System Binary Proxy ExecutionT1202 · Indirect Command Execution+1
oscd.community+2Mon Oct 05windows
Threat Huntmediumtest

Cab File Extraction Via Wusa.EXE

Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract cab using the "/extract" argument that is no longer supported.

WindowsProcess Creation
TA0002 · Executiondetection.threat-hunting
Nasreddine Bencherchali (Nextron Systems)Thu Aug 04windows