SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,696 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects a DNS server error indicating that a specified plugin DLL, configured in the registry, could not be loaded. This event can be triggered by an attacker attempting to load a malicious DLL for privilege escalation or persistence on a DNS server, often associated with techniques like DNSAdmin to DC compromise.
Detects when the 'SeEnableDelegationPrivilege' user right is assigned in Active Directory. This privilege allows a user to control other Active Directory user objects, which can be abused for privilege escalation and persistence within a domain.
This rule detects the creation of a new trust relationship to a domain, indicated by Windows Event ID 4706. The addition of domain trusts is an infrequent administrative action and should be carefully verified for legitimacy, as unauthorized trust relationships could be used for privilege escalation or persistence within an Active Directory environment.
This rule detects attempts to tamper with Sysmon's operational settings by monitoring changes to specific registry keys related to Sysmon's event publishers and channels. Specifically, it looks for modifications that disable Sysmon's 'Enabled' status (EventID 4657, NewValue 0) or attempts to delete the Sysmon operational channel (EventID 4663, AccessMask '0x10000'). This activity could indicate a threat actor trying to evade detection by disabling or muting Sysmon logging.
Detects when the Code Integrity (CI) engine blocks a process from loading an unsigned DLL that resides in a suspicious location. This often indicates an attempt to bypass security controls or execute malicious code through DLL hijacking or side-loading.
Detects the creation of a Windows service by the ProcessHacker tool, specifically when the service is configured to run with 'LocalSystem' privileges and its name starts with 'ProcessHacker'. This indicates a potential privilege escalation attempt using ProcessHacker.
Detects potential remote thread creation with specific start addresses often associated with Cobalt Strike beacons, indicating process injection activity.
Detects the loading of the kernel driver associated with the Process Hacker tool. This tool, while legitimate, can be used by adversaries for various malicious activities, including bypassing security controls, inspecting processes, and potentially escalating privileges. The rule identifies the driver by its filename and specific import hashes.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. This rule detects the creation of new custom shim database files in the default Windows shim database directories, which can indicate an attempt to abuse the Application Compatibility Infrastructure for malicious purposes.
Detects the loading of .NET Common Language Runtime (CLR) DLLs by scripting applications such as wscript, cscript, or mshta. This behavior can indicate suspicious execution, potentially involving techniques like DotNetToJScript or Donut, which use scripting hosts to execute .NET assemblies in memory. The rule specifically looks for `clr.dll`, `mscoree.dll`, or `mscorlib.dll` being loaded by a predefined list of scripting or utility executables.
Page 222 of 680