SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,679 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when an uncommon process modifies the Windows Terminal profile settings file, "settings.json". This activity can be indicative of persistence or privilege escalation attempts where an attacker modifies the terminal's startup behavior or injects malicious commands to be executed when the terminal is launched.
Detects potential DLL sideloading of Python DLL files (python39.dll, python310.dll, python311.dll, python312.dll) by monitoring image load events. The rule filters out legitimate loads from common Python installation paths, Visual Studio, Anaconda, CPython build paths, and PyInstaller bundled applications, as well as legitimately signed Python DLLs, to reduce false positives.
This rule detects the use of PowerShell cmdlets from the 'Microsoft.PowerShell.LocalAccounts' module, which are used to manipulate local user accounts. This includes actions such as disabling, enabling, getting information about, setting properties of, creating, renaming, and removing local users. Adversaries may manipulate accounts to maintain access to victim systems, modify credentials, or change permission groups.
Detects the use of Meterpreter's or Cobalt Strike's 'getsystem' command by identifying specific command-line patterns associated with privilege escalation techniques. The rule looks for processes spawned by 'services.exe' that contain '/c', 'echo', and '\pipe\' (technique 1) or 'rundll32', '.dll,a', and '/p:' (technique 2), which are indicative of these tools attempting to elevate privileges.
Detects scheduled task creation using the 'schtasks' utility that incorporates suspicious or uncommon command-line patterns. This includes tasks scheduled to run frequently (e.g., every minute) or as the 'system' user, combined with common command interpreters ('cmd'), or containing keywords often associated with malicious activity like PowerShell download commands, obfuscation techniques, or execution from temporary/public user directories. It also flags the use of scripting engines (cscript, wscript) or curl within scheduled tasks.
Detects changes to the Netsh registry key to add a new DLL value that is located in a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper.
Detects an attacker trying to enable the Outlook security setting "EnableUnsafeClientMailRules" which allows Outlook to run applications or execute macros. This can be used for persistence or defense evasion.
Detects suspicious encoded payloads within WMI Event Consumers. This rule specifically looks for base64 encoded strings containing keywords commonly associated with process injection or executable characteristics, such as 'WriteProcessMemory', 'This program cannot be run in DOS mode', and 'This program must be run under Win32'. The presence of these strings in a WMI event consumer's destination property suggests an attempt to establish persistence or execute malicious code via WMI.
Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
Detects the execution of DLL side-loading malware used by the threat group Emissary Panda, also known as APT27. Specifically, it looks for `svchost.exe` being spawned by `sllauncher.exe` or `svchost.exe` being spawned from a user's `AppData\Roaming` directory with the `-k` command-line argument, which are indicators of this specific malware's behavior.
Page 215 of 680