SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,679 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation or modification of specific registry keys that have been observed in attacks attributed to the OceanLotus (also known as APT32) threat group. The rule specifically looks for patterns in `TargetObject` paths related to CLSID entries and `AppX` entries within `HKCU\SOFTWARE\Classes` and `HKCU\SOFTWARE\App`.
Detects registry modifications associated with the exploitation of Windows vulnerabilities CVE-2021-31979 and CVE-2021-33771, which were reportedly used by the threat group Sourgum with the DevilsTongue malware. Specifically, it looks for changes to the default values of InprocServer32 for specific CLSIDs, while filtering out legitimate system DLLs.
This rule detects a suspicious `explorer.exe` subprocess spawned by `RazerInstaller.exe` with elevated privileges (System integrity level). While `explorer.exe` can be legitimately invoked by the installer to select a different installation folder, this specific behavior with System integrity can indicate an attempt to exploit a vulnerability in the RazerInstaller software for privilege escalation to LOCAL SYSTEM.
Detects potential suspicious child processes spawned by '3CXDesktopApp.exe', which could indicate compromise related to the 3CXDesktopApp supply chain attack. Specifically, it looks for the 3CXDesktopApp spawning common system binaries often abused for execution, command and control, or defense evasion.
Detects remote registry management attempts using the 'reg' utility originating from a workstation not designated as an administrator workstation. This could indicate an attacker attempting to query or modify the registry of a remote system from an unauthorized host.
Detects calls to the "New-NetFirewallRule" cmdlet from PowerShell in order to add a new firewall rule with an "Allow" action. This activity can be indicative of an adversary attempting to bypass network controls for C2, lateral movement, or data exfiltration.
This rule identifies modifications to the `/etc/ld.so.preload` file. This file is used by the Linux dynamic linker to specify shared libraries that should be loaded before any other libraries. Attackers can modify this file to inject malicious shared objects into processes, enabling privilege escalation, persistence, or defense evasion by loading arbitrary code.
Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators
This rule detects the addition of a Security Identifier (SID) to an Active Directory object's SID History attribute. Attackers can manipulate the SID History to gain unauthorized privileges, often by adding SIDs of highly privileged accounts (like Domain Admins) to a compromised user or computer object. This allows the compromised account to impersonate the privileged account and bypass access controls. The rule specifically looks for Event IDs 4765 (SID History added to an account) or 4766 (SID History added to a group) or Event ID 4738 (User Account Changed) where the 'SidHistory' field is not null or '%%1793' (which indicates no SID History).
Detects the creation of new Windows services that exhibit characteristics commonly associated with Cobalt Strike beacon activity, specifically focusing on suspicious ImagePath values. This includes services created with paths pointing to ADMIN$ shares, PowerShell commands for execution, or encoded PowerShell commands often used for downloading and executing payloads.
Page 216 of 680