SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,700 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of SettingSyncHost.exe to execute a hijacked binary. This technique leverages the legitimate Windows utility SettingSyncHost.exe, which is designed to synchronize settings across devices, to execute arbitrary commands. The rule specifically looks for instances where SettingSyncHost.exe's parent command line contains 'cmd.exe /c', 'RoamDiag.cmd', and '-outputpath', indicating an attempt to run a command-line interpreter to execute a script, while the image itself is not located in standard system directories, suggesting a hijacked execution.
Detects changes to the "NoLMHash" registry value to allow Windows to store LM Hashes. Setting this registry value to "0" (DWORD) enables the storage of LAN manager hashes of passwords in Active Directory and local SAM databases, which can facilitate 'Pass the Hash' attacks.
Detects suspicious execution of rundll32.exe with command-line arguments that indicate the invocation of inline VBScript. This behavior has been observed in attacks attributed to UNC2452 (APT29/NOBELIUM), specifically using patterns like 'Execute', 'RegRead', and 'window.close' within the command line to execute malicious VBScript.
Detects the creation of a scheduled task using `schtasks.exe` that includes `curl` for downloading content and `powershell` for execution within the task's action. This combination is often used by adversaries to establish persistence, download malicious payloads, and execute them without directly dropping malware on the host, facilitating command and control.
Detects the creation of scheduled tasks using 'schtasks.exe' where the task's executable path points to suspicious folders or uses environment variables commonly abused by malware for persistence or privilege escalation. This rule specifically looks for tasks created in locations like 'Perflogs', 'Users\All Users', 'Users\Default', 'Users\Public', 'Windows\Temp', 'AppData\Local', 'AppData\Roaming', or using '%AppData%' and '%Public%' environment variables.
Detects the creation or modification of a scheduled task using 'schtasks.exe' that is configured to run with 'NT AUTHORITY\SYSTEM' privileges. This can be an indicator of privilege escalation or persistence.
This rule detects attempts to add users to highly privileged groups on Windows systems. It specifically looks for command-line executions of 'net localgroup <groupname> /add' or 'Add-LocalGroupMember -Group <groupname>' where the group name is either 'Group Policy Creator Owners' or 'Schema Admins'. These groups are considered highly privileged, and unauthorized additions could indicate privilege escalation or persistence.
Detects the creation or modification of Windows services in the registry that exhibit patterns commonly associated with Cobalt Strike beacons for persistence, privilege escalation, or lateral movement. Specifically, it looks for registry modifications to service control sets containing 'ADMIN$' and '.exe' or '%COMSPEC%', 'start', and 'powershell' in the service details, indicating a potential malicious service installation.
Detects the disabling of crash dumps by modifying the 'CrashControl' registry key to set the 'CrashDumpEnabled' value to 0. This activity has been observed in malware like HermeticWiper to hinder forensic analysis.
Detects VBScript content stored into registry keys, specifically targeting the 'Software\Microsoft\Windows\CurrentVersion' path, which is often used for persistence. The rule looks for keywords indicative of VBScript or JScript execution, such as 'vbscript:', 'jscript:', 'mshtml,', 'RunHTMLApplication', 'Execute(', 'CreateObject', and 'window.close'. It explicitly filters out legitimate MSIEXEC activity related to .NET installations in specific registry paths to reduce false positives. This activity has been observed in campaigns by groups like UNC2452.
Page 231 of 680