SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,507 copies16 likes159,711 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application. This could indicate an adversary attempting to use Windows Remote Management (WinRM) for lateral movement or execution without directly invoking PowerShell, potentially to evade detection.
This rule detects potential DLL sideloading of 'EACore.dll'. It specifically looks for instances where 'EACore.dll' is loaded by an executable, but the executable or the loaded DLL is not from the legitimate 'C:\Program Files\Electronic Arts\EA Desktop\EACoreServer.exe' path. This technique can be used by adversaries for persistence, defense evasion, and privilege escalation by tricking legitimate applications into loading malicious DLLs.
Detects potential DLL sideloading of "mfdetours.dll" when loaded by a process other than the legitimate "mftrace.exe" from its expected path. This technique can be abused to force load a malicious DLL named "mfdetours.dll" from the current directory of execution, allowing for persistence, privilege escalation, or defense evasion.
This rule detects attempts to exploit a DLL search order hijacking vulnerability in the Windows Fax service. Specifically, it looks for instances where the 'fxssvc.exe' process attempts to load 'ualapi.dll' from a location other than the legitimate Windows system directories (e.g., 'C:\Windows\WinSxS\'). This indicates that an attacker may have placed a malicious 'ualapi.dll' in a directory that the Fax service searches before the legitimate system path, leading to the execution of the attacker's code.
Detects the loading of 'glib-2.0.dll' by the 'VMwareXferlogs.exe' utility from a directory other than the default VMware installation path. This behavior is indicative of potential DLL sideloading, where an attacker might place a malicious DLL in a non-standard location to be loaded by a legitimate application, often for privilege escalation, persistence, or defense evasion.
Detects the loading and execution of an unsigned Thor scanner binary. This rule specifically looks for 'thor.exe' or 'thor64.exe' being loaded, and then filters out instances where the binary is legitimately signed by 'Nextron Systems GmbH' with a valid signature status. This helps identify potentially malicious or unauthorized versions of the Thor scanner.
Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
This rule detects process injection activities originating from Microsoft Word (winword.exe) that are characteristic of a LittleCorporal generated malicious document. Specifically, it looks for winword.exe as the source image performing process access, combined with a call trace that includes a .NET Framework 64-bit v2.x path and an 'UNKNOWN' module, which is indicative of injected code.
This rule detects the use of `bitsadmin.exe` to create or modify BITS jobs that can be used for persistence. Specifically, it looks for command-line arguments that either set a notification command (`/SetNotifyCmdLine`) to execute a program (like `cmd.exe` or `regsvr32.exe`) or add a file for download (`/Addfile`) from a remote HTTP/HTTPS/FTP source. Adversaries can abuse BITS jobs to schedule the download and execution of malicious binaries, establishing a backdoor and maintaining persistence on a system.
Detects the execution of Chromium-based browsers (Brave, Chrome, MS Edge, Opera, Vivaldi) in headless mode using the "dump-dom" command-line argument. This technique can be used to download files or extract content from web pages without a visible browser interface, often for malicious purposes like data exfiltration or staging.
Page 238 of 680