SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,780 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the use of 'wbadmin.exe' to recover files from backups. Adversaries may use this technique to restore sensitive files, such as NTDS.DIT (Active Directory database) or Registry Hives, from backups. These files can then be analyzed offline to extract credentials or other sensitive information, potentially leading to further compromise.
Detects the execution of "AdPlus.exe", a legitimate Windows SDK binary that can be abused as a Living Off The Land Binary (LOLBIN) to dump process memory (potentially including LSASS) or execute arbitrary commands. The rule specifically looks for command-line arguments indicative of these malicious uses, such as dumping process memory, using a config file, or executing inline commands.
Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D). Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary. The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks. This rule flags suspicious use of such padding observed in real-world attacks.
Detects the use of 'wbadmin.exe' to recover highly sensitive files such as 'NTDS.DIT', 'SAM', 'SECURITY', and 'SYSTEM' hives. Attackers can leverage this utility to dump sensitive files that might contain credential or other sensitive information.
Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecureDesktop" value. The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that's isolated from other processes running on the system. It's designed to prevent malicious software from intercepting or tampering with UAC prompts. When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user's current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software.
Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive using the `wbadmin.exe` utility. Attackers can leverage `wbadmin` to dump sensitive files that might contain credentials or other sensitive information.
Detects the enabling of the Windows Recall feature by deleting the "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host and is subsequently enabled by an adversary.
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
Detects when a user attaches a Lambda layer to an existing AWS Lambda function. A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role, potentially granting an adversary access to resources the function has access to. This activity could indicate privilege escalation or unauthorized modification of serverless functions.
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. This rule helps identify potential suspicious processes that have escalated privileges.
Page 353 of 680