SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,786 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects a suspicious child process spawning from Microsoft Outlook where the executable image is located on a remote share (SMB/WebDav). This behavior is often associated with adversaries using Outlook to execute malicious code from network shares, potentially as part of persistence or execution techniques.
Detects the execution of AdFind.exe, a legitimate command-line tool often used by adversaries for Active Directory reconnaissance. The rule specifically looks for renamed AdFind executables by checking for specific command-line arguments and known ImpHashes, while excluding executions of the original 'AdFind.exe' name.
Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value where it is set to "1" to disable the Hypervisor Enforced Paging Translation feature. This action can be taken by adversaries to evade detection by security tools that rely on this feature for monitoring or integrity checks, potentially facilitating kernel exploits or rootkit installations.
Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.
Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location. This technique can be used by adversaries to execute malicious code by tricking a legitimate application into loading a malicious DLL instead of its legitimate counterpart.
Detects the creation of a malicious DLL file named 'iphlpapi.dll' within the 'AppData\Local\Microsoft' directory, which is commonly used by applications like Microsoft Teams or OneDrive. This technique is often employed for DLL sideloading, where a legitimate application loads a malicious DLL placed in a specific directory, leading to code execution, persistence, privilege escalation, or defense evasion.
Detects the loading of Microsoft Office DLLs, specifically 'outllib.dll', from non-standard file system locations. This behavior is indicative of DLL sideloading, a technique used by adversaries for defense evasion, persistence, and privilege escalation.
Detects the creation of system DLLs that are usually not present on the system (or at least not in system directories). This technique is commonly used to achieve DLL hijacking, which can lead to defense evasion, persistence, and privilege escalation.
This rule detects attempts to bypass User Account Control (UAC) by loading a fake 'dismcore.dll' with 'dism.exe'. This technique involves placing a malicious 'dismcore.dll' in a location where 'dism.exe' will load it instead of the legitimate system DLL, often leading to privilege escalation.
This rule detects potential DLL sideloading of 'CCleanerReactivator.dll'. It specifically looks for instances where 'CCleanerReactivator.dll' is loaded by an image that is NOT the legitimate 'CCleanerReactivator.exe' located in the standard CCleaner installation paths ('C:\Program Files\CCleaner\' or 'C:\Program Files (x86)\CCleaner\'). This behavior can indicate an adversary attempting to execute malicious code by tricking a legitimate application into loading a malicious DLL.
Page 343 of 680