SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,696 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potential remote thread creation with specific start addresses often associated with Cobalt Strike beacons, indicating process injection activity.
Detects the loading of the kernel driver associated with the Process Hacker tool. This tool, while legitimate, can be used by adversaries for various malicious activities, including bypassing security controls, inspecting processes, and potentially escalating privileges. The rule identifies the driver by its filename and specific import hashes.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. This rule detects the creation of new custom shim database files in the default Windows shim database directories, which can indicate an attempt to abuse the Application Compatibility Infrastructure for malicious purposes.
Detects the loading of .NET Common Language Runtime (CLR) DLLs by scripting applications such as wscript, cscript, or mshta. This behavior can indicate suspicious execution, potentially involving techniques like DotNetToJScript or Donut, which use scripting hosts to execute .NET assemblies in memory. The rule specifically looks for `clr.dll`, `mscoree.dll`, or `mscorlib.dll` being loaded by a predefined list of scripting or utility executables.
Detection of unusual child processes (PowerShell or Command Prompt) spawned by critical system processes (winlogon.exe, services.exe, lsass.exe, csrss.exe, smss.exe, wininit.exe, spoolsv.exe, searchindexer.exe) running under an authorized user context. This behavior can indicate privilege escalation or defense evasion, especially if the spawned process is not related to legitimate network routing commands.
This rule detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Specifically, it looks for the creation of a process where the parent process is 'mmc.exe' and its command line contains 'WF.msc', while filtering out legitimate 'WerFault.exe' processes.
This rule detects a specific UAC bypass method known as 'TrustedPath UAC Bypass'. This technique involves creating specially crafted directories that mimic legitimate Windows system paths (e.g., 'C:\Windows \System32\') to trick the operating system into executing an untrusted application with elevated privileges without a UAC prompt. The detection logic specifically looks for process creation events where the image path contains these malformed system directory names.
Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup. This rule detects the modification of registry keys under 'Control\Print\Monitors\' where a DLL is specified, indicating the potential for port monitor persistence.
Detects modifications to specific registry keys under 'Software\Policies\Microsoft\Windows\System\Scripts' related to system startup, shutdown, logon, and logoff scripts. These modifications can be used to establish persistence or escalate privileges by executing malicious code at various system events.
Detects registry value settings that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.
Page 223 of 680