SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,712 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of 'runonce.exe' with specific command-line arguments, indicating the execution of a Run Once task as configured in the registry. This is a common method for persistence and defense evasion on Windows systems.
Detects the creation of a scheduled task using 'schtasks.exe' that is configured to execute a file from the 'C:\Users\<USER>\AppData\Local' directory. This behavior is often indicative of malware establishing persistence or privilege escalation, as the AppData\Local folder is a common location for user-specific application data and can be written to without administrative privileges. The rule specifically looks for tasks created to run under 'NT AUTHORITY\SYSTEM' or 'SYSTEM' accounts, which would grant elevated privileges to the executed payload.
This rule detects the creation of scheduled tasks using 'schtasks.exe' where the command line includes common scripting interpreters (powershell, pwsh, cmd) and specifies a suspicious folder path like 'C:\ProgramData\' or '%ProgramData%'. This combination is often used by adversaries for persistence or privilege escalation by scheduling malicious code to run from a location typically used for application data, which can be less monitored than system directories.
Detects the creation or modification of scheduled tasks using `schtasks.exe` with suspicious schedule types such as 'ONLOGON', 'ONSTART', 'ONCE', or 'ONIDLE'. This rule specifically filters out common legitimate system accounts like 'NT AUTHORITY\SYSTEM' and 'SYSTEM' and the 'HIGHEST' privilege setting to reduce false positives.
Detects the creation of a scheduled task using 'schtasks.exe' that is configured to execute a PowerShell command. The PowerShell command specifically attempts to retrieve a base64 encoded payload from the Windows Registry (HKCU or HKLM hive) and execute it. This technique is often used by adversaries for persistence and to evade detection by obfuscating the malicious payload.
Detects the creation or modification of scheduled tasks using 'schtasks.exe' that are configured to run with high privileges (NT AUTHORITY\SYSTEM, SYSTEM, or HIGHEST) and utilize suspicious schedule types such as ONLOGON, ONSTART, ONCE, or ONIDLE. This combination is often indicative of persistence or privilege escalation attempts by adversaries.
Detects the Windows Installer service (msiexec.exe) attempting to install MSI packages with SYSTEM privileges, which can be indicative of privilege escalation through the 'AlwaysInstallElevated' policy.
This rule detects the execution of 'VBoxDrvInst.exe' with specific parameters ('driver' and 'executeinf') that allow it to process INF files. This capability can be abused to create registry values and install drivers, potentially leading to persistence mechanisms such as modifying Run or RunOnce registry keys.
Detects the creation of a process where the parent process is 'EdgeTransport.exe' and the child process is not 'conhost.exe' or 'OleConverter.exe'. This behavior is indicative of a WMI backdoor being used in Exchange Transport Agents, leveraging WMI event filters for persistence or execution.
Detects the execution of the Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused to side-load a custom version of "xwizards.dll", which can be used for privilege escalation, persistence, or defense evasion.
Page 245 of 680