SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,706 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects a suspicious printer driver installation where the 'Manufacturer' registry value is set to an empty string. This behavior can be indicative of malicious activity, potentially related to privilege escalation or defense evasion, as seen in some exploits like PrintNightmare (CVE-2021-1675).
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.
Detects potential DLL sideloading of 'iviewers.dll' (OLE/COM Object Interface Viewer) when it is loaded from a location other than the legitimate Windows Kits directories. This technique can be used for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of "SolidPDFCreator.dll" when loaded by an executable other than "SolidPDFCreator.exe" or from an unexpected directory. This technique can be used by adversaries for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of 'wwlib.dll' by identifying instances where 'wwlib.dll' is loaded by an executable that is NOT a legitimate Microsoft Office Word process. This rule specifically filters out loads from standard Microsoft Office installation paths for 'winword.exe' to reduce false positives.
This rule detects when the 'notepad.exe' process initiates a network connection. This behavior is highly unusual for Notepad and can indicate malicious activity such as process injection where a beacon or other malicious code is running within the legitimate Notepad process to establish command and control. Notepad typically only initiates network communication when printing documents, which is filtered out by this rule.
This rule detects PowerShell scripts that attempt to retrieve Access Control Lists (ACLs) for service-related registry keys under HKLM\SYSTEM\CurrentControlSet\Services. This activity could indicate an adversary performing reconnaissance for service registry permissions weaknesses, which can be exploited for privilege escalation or persistence. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services if permissions are misconfigured.
This rule detects attempts by a process to access the memory of 'svchost.exe' with a specific access right ('0x143a'), which is indicative of a credential dumping attempt. The rule filters out legitimate access from 'services.exe' and 'msiexec.exe' to reduce false positives.
Detects the execution of the VMware Xfer utility (VMwareXferlogs.exe) from a directory other than its default installation path. This behavior is indicative of an attempt to sideload arbitrary DLLs, often used by adversaries for privilege escalation, persistence, or defense evasion. The rule specifically looks for instances where 'VMwareXferlogs.exe' is executed from a location not starting with 'C:\Program Files\VMware\'.
Page 236 of 680