SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,700 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects file association changes using the built-in "assoc" command. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.
Detects when the `assoc` command-line utility is used to change the default file association of any extension to an executable (`exefile`). This technique can be used by adversaries for persistence or privilege escalation by making a specific file type execute a malicious program when opened.
Detects the execution of KrbRelayUp, a hack tool used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced. The rule identifies the tool by its executable name or original filename and specific command-line arguments associated with its relay, krbscm, and spawn functionalities.
This rule detects suspicious modifications to screensaver settings in the Windows Registry using `reg.exe`. Adversaries may manipulate these settings to establish persistence by executing malicious content when a user is inactive. Specifically, it looks for `reg.exe` commands that modify the `ScreenSaveActive`, `ScreenSaveTimeout`, `ScreenSaverIsSecure`, or `SCRNSAVE.EXE` registry values within `HKEY_CURRENT_USER\Control Panel\Desktop` or `HKCU\Control Panel\Desktop` with the `/f` (force) flag.
This rule detects the execution of 'vmnat.exe' when its filename has been changed. Adversaries may rename legitimate executables to evade detection, especially when attempting DLL side-loading. The rule specifically looks for processes where the original filename is 'vmnat.exe' but the executed image file path does not end with 'vmnat.exe'. This behavior could indicate an attempt to leverage a legitimate, signed executable for malicious purposes, such as DLL side-loading, where a malicious DLL is placed in the same directory as the renamed legitimate executable.
Detects suspicious PowerShell execution initiated by a scheduled task (svchost.exe -k netsvcs -s Schedule) where the PowerShell command line includes flags commonly used to hide the PowerShell instance or bypass execution policies, such as '-windowstyle hidden', '-w hidden', '-ep bypass', or '-noni'. This pattern is indicative of persistence mechanisms, specifically referencing the PowerShell 'Get-Variable' technique used by Colibri Loader.
This rule detects attempts by non-privileged users (IntegrityLevel: Medium or S-1-16-8192) to modify Windows service configurations in the registry. It specifically looks for command-line executions of 'reg' with 'add' or 'powershell' with 'set-itemproperty', 'sp', or 'new-itemproperty' that target service-related registry paths (containing 'ControlSet' and 'Services') and modify critical service parameters like 'ImagePath', 'FailureCommand', or 'ServiceDLL'. This activity could indicate an attempt to establish persistence or elevate privileges by hijacking service execution.
Detects potential persistence activity via Outlook Home Page by monitoring modifications to specific registry keys. An attacker can set a home page URL in Outlook's WebView registry keys to achieve code execution and persistence when a user opens a folder in Outlook.
Detects the installation of a new shim database where the file is located in a non-default location. This can be an indicator of persistence or privilege escalation attempts using application shimming.
This rule detects modifications to the 'NoLMHash' registry value, specifically when it is set to '0' (DWORD). Setting this value to '0' allows Windows to store LAN Manager (LM) hashes of user passwords in Active Directory and local Security Account Manager (SAM) databases. This action significantly weakens security as LM hashes are highly vulnerable to cracking, making credential theft easier for attackers. Attackers often enable LM hash storage to facilitate 'Pass the Hash' attacks or offline password cracking.
Page 229 of 680