SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,706 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the loading of 'wbemcons.dll' by 'WmiPrvSE.exe', which is indicative of a WMI command line event consumer being used for persistence. This technique is often leveraged by adversaries to maintain access and execute code when specific WMI events occur.
Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in the registry using dnscmd.exe, which can be used to execute code in the context of the DNS server (restart required). This technique can be used for privilege escalation or persistence.
This rule detects the suspicious execution of 'explorer.exe' with the '/NOUACCHECK' command-line flag. This flag can be used to bypass User Account Control (UAC) checks for all subprocesses launched by the newly started explorer.exe instance, potentially allowing an attacker to elevate privileges or execute malicious code without user interaction. The rule filters out legitimate instances where 'explorer.exe' is launched by the Windows Task Scheduler service ('svchost.exe -k netsvcs -p -s Schedule').
Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.
Detects the execution of PktMon.exe, a legitimate Windows utility that can be used to capture network packets. Adversaries may abuse this tool for network sniffing to gather information about the environment, including potential credentials or network configurations.
Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable.
Detects the execution of 'register-cimprovider.exe' with command-line arguments indicating an attempt to register a DLL. This technique can be used by adversaries to achieve persistence, privilege escalation, or defense evasion by loading malicious DLLs through a legitimate Windows binary.
Detects the execution of ScreenConnect, a legitimate remote access tool, when it is used to establish a remote access session. The rule specifically looks for command-line arguments indicative of a guest connection to a ScreenConnect session.
This rule detects the execution of a renamed 'dctask64.exe' binary. 'dctask64.exe' is a legitimate, signed executable by ZOHO Corporation, part of ManageEngine Endpoint Central. Adversaries can abuse this binary for malicious purposes such as DLL injection, arbitrary command execution, and process execution. The detection logic specifically looks for process creation events where the image hash matches known hashes of 'dctask64.exe' but the filename is not 'dctask64.exe', indicating a potential masquerading attempt.
Page 234 of 680