SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,712 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation of suspicious child processes by 'KeyScrambler.exe'. KeyScrambler is legitimate software designed to encrypt keystrokes, but if compromised, it could be used to launch malicious binaries. The rule specifically looks for 'KeyScrambler.exe' as a parent process launching common Windows utilities often abused by attackers, such as 'cmd.exe', 'cscript.exe', 'mshta.exe', 'powershell.exe', 'pwsh.exe', 'regsvr32.exe', 'rundll32.exe', and 'wscript.exe'. This behavior could indicate an attacker leveraging a compromised KeyScrambler process for execution, defense evasion, or privilege escalation.
This rule detects the use of 'pnputil.exe' to install or add drivers on a Windows system. Adversaries may use this utility to install malicious or vulnerable drivers for privilege escalation, persistence, or to bypass security controls. The detection specifically looks for command-line arguments indicative of driver installation, such as '-i', '/install', '-a', '/add-driver', and the presence of '.inf' in the command line.
Detects the suspicious execution of 'grpconv.exe' with the '-o' flag, which can be used to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors. This command-line usage is uncommon in legitimate environments and may indicate an attempt to establish persistence or escalate privileges.
This rule detects potential DLL injection or execution attempts using 'Tracker.exe', a legitimate Microsoft binary that can be abused. The detection specifically looks for 'Tracker.exe' being executed with command-line arguments '/d' or '/c', which are indicative of its use in loading or executing DLLs. It filters out common false positives related to MSBuild processes.
Detects potential DLL sideloading of "mpclient.dll" by legitimate Windows Defender processes ("MpCmdRun.exe" and "NisSrv.exe") when they are executed from a non-standard directory. This technique can be used by adversaries to execute malicious code under the guise of a trusted process, potentially leading to privilege escalation, persistence, or defense evasion.
Detects direct modification of autostart extensibility point (ASEP) in the Windows Registry using the `reg.exe` utility. This rule specifically looks for the 'add' command within `reg.exe` command lines targeting common Run keys and other autostart locations.
Detects when the 'reg.exe' utility is used to add or modify registry keys or subkeys in suspicious locations. These locations include paths related to AppDataLow, Windows OOBE policies, Winlogon, WDigest security providers, and Windows Defender. Such modifications can be indicative of persistence mechanisms, defense evasion, or other malicious activities.
This rule detects attempts to clear the ShimCache, a component of the Application Compatibility Database, which stores metadata about executed applications. Adversaries may clear this cache to remove forensic evidence of their activities. The rule specifically looks for command-line executions involving 'rundll32' with 'apphelp.dll' and 'ShimFlushCache' or '#250', or 'rundll32' with 'kernel32.dll' and 'BaseFlushAppcompatCache' or '#46'.
This rule detects the execution of 'runonce.exe' with specific command-line arguments, indicating the execution of a Run Once task as configured in the registry. This is a common method for persistence and defense evasion on Windows systems.
Detects the creation of a scheduled task using 'schtasks.exe' that is configured to execute a file from the 'C:\Users\<USER>\AppData\Local' directory. This behavior is often indicative of malware establishing persistence or privilege escalation, as the AppData\Local folder is a common location for user-specific application data and can be written to without administrative privileges. The rule specifically looks for tasks created to run under 'NT AUTHORITY\SYSTEM' or 'SYSTEM' accounts, which would grant elevated privileges to the executed payload.
Page 244 of 680