SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,687 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution pattern associated with the TAIDOOR RAT malware loading its DLL component. Specifically, it looks for command-line arguments containing 'dll,MyStart' or 'dll MyStart' in conjunction with 'rundll32.exe', which is a known method for TAIDOOR to load its malicious DLL.
Detects specific command-line characteristics associated with the Winnti Pipemon malware, as reported by ESET. The rule looks for `setup0.exe -p` or `setup.exe` with command-line arguments ending in `-x:0`, `-x:1`, or `-x:2`.
Detects the creation or modification of specific files associated with the exploitation of Windows vulnerabilities CVE-2021-31979 and CVE-2021-33771, and the deployment of DevilsTongue malware by the threat group Sourgum. The rule specifically looks for the presence of certain filenames in critical system directories.
Detects the loading of 'oci.dll' by 'msdtc.exe', which is indicative of the Pingback backdoor. This backdoor is known to establish an ICMP tunnel for command and control communication.
Detects a specific command line argument being passed to a binary, which has been observed in use by the Small Sieve malware. The rule specifically looks for command lines ending with '.exe Platypus'.
Detects potential sideloading of malicious "aclui.dll" by OleView. This behavior was observed in Raspberry-Robin variants reported by Checkpoint Research in February 2024. The rule specifically looks for OleView.exe loading aclui.dll, while filtering out known legitimate paths and signed executables to reduce false positives.
Detects the setting of a DLL that handles a custom protocol handler, specifically targeting a CLSID observed in attacks attributed to Forest Blizzard APT. This technique can be used for persistence or privilege escalation by registering a malicious DLL to be loaded when a specific protocol is invoked.
Detects file access requests to files ending with either the ".hive" or ".reg" extension, which are typically associated with Windows Registry backups. The rule specifically looks for these accesses by applications not located in common system directories (C:\Program Files (x86)\, C:\Program Files\, C:\Windows\System32\, C:\Windows\SysWOW64\), indicating potentially suspicious activity by uncommon or unauthorized applications.
Detects changes to the registry keys related to "Trusted Location" of Microsoft Office. Attackers might add additional trusted locations to avoid macro security restrictions.
Detects the creation of an Inline IAM policy by the 'S3 Browser' utility, where the policy still contains the default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>" instead of a specific bucket name. This indicates a potential misconfiguration or an attempt to create a broad policy that might be further exploited.
Page 221 of 680