SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,717 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation or modification of Windows Registry 'Run' keys that point to executable files located in suspicious directories. Adversaries often use 'Run' keys for persistence, ensuring their malicious code executes automatically when a user logs in. By monitoring these keys for entries pointing to common temporary, user-specific, or system-related folders that are not typically used for legitimate application startup, the rule aims to identify potential malicious persistence mechanisms. The rule includes filters for known legitimate activities, such as Windows Update and Spotify, to reduce false positives.
Detects the modification of the Windows Registry to configure a driver or service to persist and load even when the system is booted into Safe Mode (Minimal or Network). This technique can be used by adversaries to maintain access and execute malicious code in a restricted environment, potentially bypassing security controls that are not active in Safe Mode.
Detects potential DLL sideloading of 'roboform.dll' or 'roboform-x64.dll' when loaded by an executable that is not the legitimate RoboForm application (robotaskbaricon.exe or robotaskbaricon-x64.exe) or is loaded from an unexpected path outside of the standard RoboForm installation directories. This technique can be used for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of "ShellDispatch.dll" by monitoring image load events. The rule specifically looks for instances where 'ShellDispatch.dll' is loaded from locations other than typical legitimate temporary directories (like ':\Users\*\AppData\Local\Temp\' or ':\Windows\Temp\'), which could indicate malicious activity.
Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus. This rule specifically looks for the loading of 'SmadHook32c.dll' or 'SmadHook64c.dll' by any process other than the legitimate SmadAV executables ('SmadavProtect32.exe' or 'SmadavProtect64.exe') from their expected installation paths.
Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") when the DLL is loaded from a non-default or unexpected directory. This technique can be used for privilege escalation, persistence, and defense evasion.
Detects suspicious outbound network connections initiated by Microsoft Sync Center (mobsync.exe) to non-private IP addresses. This activity is unusual for mobsync.exe, which typically handles offline file synchronization and should primarily communicate with internal network resources or specific cloud services, not arbitrary external IPs. Such connections could indicate compromise or malicious use of a legitimate system binary.
This rule detects the execution of the 'Reset-ComputerMachinePassword' PowerShell cmdlet. This cmdlet is used to change the computer account password that systems use to authenticate to domain controllers. Malicious use of this cmdlet can indicate an attempt to reset the local computer's password, potentially for privilege escalation, persistence, or defense evasion, as seen in some Qbot and ZeroLogon attacks.
Detects the import of '.reg' files from suspicious user-controlled or temporary paths using the 'reg.exe' utility. This activity can be indicative of an adversary attempting to modify the Windows Registry for persistence, defense evasion, or other malicious purposes by importing registry keys from a location that is easily written to.
Detects the use of regedit.exe to import a registry file (.reg) into the Windows Registry. This activity can be used by adversaries for various purposes, including establishing persistence, modifying system configurations, or defense evasion.
Page 248 of 680