SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,786 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when an attacker creates a similar folder structure to Windows system folders (such as Windows, Program Files) but with an additional space in the directory name. This technique aims to trick the DLL load search order, leading to a "DLL Search Order Hijacking" attack where a malicious DLL can be loaded instead of a legitimate one.
Detects potential DLL sideloading of "7za.dll". This technique involves an attacker placing a malicious DLL (named 7za.dll in this case) in a location where a legitimate application expects to load a benign version of the DLL. By doing so, the malicious DLL is loaded and executed by the legitimate application, allowing the attacker to achieve defense evasion, persistence, or privilege escalation. The rule specifically looks for instances where '7za.dll' is loaded by an executable not residing in standard 'Program Files' directories, which are typically trusted locations.
Detects potential DLL sideloading of "CCleanerDU.dll" when loaded by an executable that is not the legitimate CCleaner application (CCleaner.exe or CCleaner64.exe) or is not located in the standard CCleaner installation paths.
Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software
This rule detects potential DLL sideloading of "chrome_frame_helper.dll". It triggers when "chrome_frame_helper.dll" is loaded from a location other than the legitimate Google Chrome application directories (C:\Program Files\Google\Chrome\Application\ or C:\Program Files (x86)\Google\Chrome\Application\) or the user's local AppData path for Chrome.
Detects potential DLL sideloading using comctl32.dll by monitoring specific Windows executables loading this DLL from a '.local' directory, which is a common technique for privilege escalation and defense evasion.
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
This rule detects potential DLL sideloading attempts involving specific third-party software DLLs. It identifies when 'commfunc.dll' (associated with Lenovo software) or 'tosbtkbd.dll' (associated with Toshiba Bluetooth software) are loaded from unexpected or non-standard paths. The rule aims to catch instances where an attacker might place a malicious DLL with the same name in a location that a legitimate application will load before its intended, legitimate DLL, thereby achieving execution, persistence, privilege escalation, or defense evasion.
This rule detects potential DLL sideloading attempts targeting DLLs associated with the Wazuh security platform. Specifically, it looks for `libwazuhshared.dll` or `libwinpthread-1.dll` being loaded from locations outside of standard program file directories (e.g., `C:\Program Files\` or `C:\Program Files (x86)\`). It also filters out common legitimate loads of `libwinpthread-1.dll` from `AppData` or `ProgramData` within `mingw64` paths.
This rule detects potential DLL sideloading of an unsigned 'dbghelp.dll' by the Sysinternals tool VMMap. Adversaries may place a malicious, unsigned 'dbghelp.dll' in a location where VMMap (vmmap.exe or vmmap64.exe) will load it instead of the legitimate, signed version. This technique can be used for defense evasion, persistence, or privilege escalation by executing arbitrary code within the context of a trusted application.
Page 344 of 680