SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,700 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects modifications to the Winlogon Notify registry key to establish persistence. Adversaries may abuse Winlogon's features to execute DLLs when a user logs in. The rule specifically looks for changes to the `\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logon` registry key where the `Details` field indicates a DLL file (`.dll`) is being set.
Detects execution of ChromeLoader malware via a registered scheduled task, specifically looking for PowerShell executing Chrome with a `--load-extension` argument pointing to a suspicious local path.
This rule detects changes to an application's Uniform Resource Identifier (URI) configuration within Azure. Such changes can include modifications to domain names, protocol usage (e.g., switching from HTTPS), the introduction of wildcards, or URIs pointing to uncontrolled domains. These types of modifications can be indicative of an attacker attempting to redirect traffic, establish persistence, or facilitate other malicious activities by altering how an application is accessed or interacts with external resources.
Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.
Detects the creation of doas.conf file in linux host platform.
This rule detects attempts to disable Event Tracing for Windows (ETW) logging specifically for .NET processes by modifying registry values. Adversaries might do this to impair defensive capabilities and hide their activities, particularly when using .NET-based malware or tools.
Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.
This rule detects the creation of suspicious executable files (.dll or .exe) by Microsoft Sync Center (mobsync.exe). While mobsync.exe is a legitimate Windows process for synchronizing offline files, its use to create executable files can be indicative of malicious activity, such as persistence, defense evasion, or privilege escalation, where an attacker might be attempting to drop and execute malicious payloads using a trusted system binary.
This rule detects the creation of 'WerFault.exe' or 'wer.dll' in directories other than the standard Windows system folders (C:\Windows\SoftwareDistribution\, C:\Windows\System32\, C:\Windows\SysWOW64\, C:\Windows\WinSxS\). This activity is highly suspicious and could indicate an attempt at DLL hijacking, specifically targeting the Windows Error Reporting process (WerFault) for privilege escalation, persistence, or defense evasion.
This rule detects attempts to establish persistence and elevate privileges by replacing the sticky keys executable (sethc.exe) with cmd.exe. This technique allows an attacker to gain a privileged command prompt on the Windows logon screen without authentication, typically by pressing the Shift key five times. The rule specifically looks for command-line arguments indicating the copying of cmd.exe to sethc.exe.
Page 230 of 680