SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,705 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of WinSCP from any directory other than its standard installation path, 'C:\Program Files (x86)\WinSCP\'. This behavior can indicate the use of a portable version of WinSCP, which might be employed by adversaries for data exfiltration or other malicious activities to avoid detection by standard software inventory or whitelisting solutions. The rule specifically looks for process creation events where the image name ends with 'WinSCP.exe' or the original filename is 'winscp.exe', and then filters out executions originating from the legitimate installation directory.
Detects execution of processes with image paths starting with WebDAV shares (\\), which might indicate malicious file execution from remote web shares.
Execution of processes from WebDAV shares can be a sign of lateral movement or exploitation attempts, especially if the process is not a known legitimate application.
Exploitation Attempt of vulnerabilities like CVE-2025-33053 also involves executing processes from WebDAV paths.
Execution of processes from WebDAV shares can be a sign of lateral movement or exploitation attempts, especially if the process is not a known legitimate application.
Exploitation Attempt of vulnerabilities like CVE-2025-33053 also involves executing processes from WebDAV paths.
Detects the creation of scheduled tasks in the `C:\Windows\System32\Tasks` directory by processes originating from suspicious locations such as user `AppData` folders, `C:\PerfLogs`, or `C:\Windows\System32\config\systemprofile`. This activity can indicate persistence or privilege escalation attempts by malware or adversaries.
This rule detects attempts to write files to the local administrative share (ADMIN$) on a Windows system, specifically when the target is the local machine (127.0.0.0/8 IP range). Adversaries often use administrative shares for lateral movement, persistence, or to stage tools and data during post-exploitation activities. The detection logic looks for file events where the target filename contains both a local loopback IP address (e.g., \\127.0.0.1) and the administrative share name 'ADMIN$'.
Detects potential DLL sideloading of "appverifUI.dll" when loaded by an 'appverif.exe' process from a non-standard or suspicious location. This rule aims to identify instances where an attacker might place a malicious 'appverifUI.dll' in a directory that 'appverif.exe' would load before its legitimate counterpart, leading to execution of the malicious DLL.
Detects potential DLL sideloading of "waveedit.dll" when loaded by an executable outside of the legitimate Nero WaveEditor installation paths. This technique is often used by adversaries for persistence, privilege escalation, and defense evasion.
This rule detects PowerShell script blocks that modify the Windows Registry keys associated with Winlogon helper DLLs. Adversaries can modify these keys to load and execute malicious DLLs or executables when a user logs on, achieving persistence and potentially privilege escalation. The rule specifically looks for the string 'CurrentVersion\Winlogon' in conjunction with PowerShell cmdlets like 'Set-ItemProperty' or 'New-Item', indicating an attempt to alter Winlogon's configuration.
Detects the execution of Chromium-based browsers (Brave, Chrome, MS Edge, Opera, Vivaldi) in headless mode. This behavior can be abused by adversaries for various purposes, including web scraping, automated data exfiltration, or as part of command and control activities, often to avoid displaying a visible browser window to the user.
This rule detects attempts to manipulate Control Panel Items, which can be used by adversaries for privilege escalation, execution, or defense evasion. It specifically looks for two main scenarios: 1) The use of 'reg.exe' to add entries to the 'CurrentVersion\Control Panel\CPLs' registry key, which is a known method for registering malicious Control Panel items. 2) The execution of '.cpl' files outside of standard system directories, indicating potentially malicious or unusual Control Panel item activity. The rule filters out common legitimate system CPL executions to reduce false positives.
Detects various execution patterns associated with the CrackMapExec (CME) pentesting framework. This includes specific command-line arguments used by CME for remote command execution via `cmd.exe` (targeting WMI or scheduled tasks for output redirection) and PowerShell execution with common obfuscation or encoding techniques.
Page 232 of 680