SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,712 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potential DLL sideloading of "mscorsvc.dll" by identifying instances where this DLL is loaded from a location other than the standard Microsoft .NET Framework or WinSxS directories. This behavior can indicate an attacker attempting to execute malicious code by tricking a legitimate application into loading a rogue DLL.
Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution. This technique can be used for persistence, defense evasion, and privilege escalation.
This rule detects potential DLL sideloading of 'MpSvc.dll'. It specifically looks for instances where 'MpSvc.dll' is loaded from a location other than the legitimate Windows Defender directories or the WinSxS directory. This technique can be used by adversaries to achieve persistence, escalate privileges, or evade defenses by tricking a legitimate application into loading a malicious DLL.
Detects potential DLL sideloading of 'rcdll.dll' by monitoring image load events. The rule specifically looks for 'rcdll.dll' being loaded from locations other than standard Microsoft Visual Studio or Windows Kits directories, which are considered legitimate paths for this DLL. This activity can indicate an adversary attempting to execute malicious code by tricking a legitimate application into loading a rogue DLL.
Detects the loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary from the "C:\$SysReset\Framework\Stack\" directory. This behavior is suspicious because the "$SysReset" directory is not created by default, suggesting an adversary might be abusing this path for DLL sideloading to achieve persistence, privilege escalation, or defense evasion.
Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" when "SystemResetPlatform.exe" is executed from a non-default, suspicious location. This technique can be used for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of "vivaldi_elf.dll" when it is loaded by an executable other than the legitimate Vivaldi browser application. This technique can be used for persistence, defense evasion, and privilege escalation by tricking a legitimate application into loading a malicious DLL.
This rule detects the execution of 'csi.exe' or 'rcsi.exe', which are signed Microsoft binaries associated with Visual Studio. These executables provide C# interactive capabilities and can be abused by adversaries to run arbitrary C# code from a file, potentially bypassing application whitelisting and enabling execution or defense evasion. The rule specifically looks for the process image ending with '\csi.exe' or '\rcsi.exe' or the original filename being 'csi.exe' or 'rcsi.exe', combined with the company name 'Microsoft Corporation'.
Detects the use of the PhoneDeepLink parameter with DeviceEnroller.exe to potentially sideload a non-existent DLL file named "ShellChromeAPI.dll". Adversaries can leverage this technique by dropping their own renamed malicious DLL and executing it via DeviceEnroller.exe using this parameter.
Detects an anomalous execution of 'dllhost.exe' where the process spawns without any command-line arguments. This behavior is highly unusual for legitimate 'dllhost.exe' processes and can indicate malicious activity such as process injection or malware attempting to masquerade as a legitimate system process.
Page 243 of 680