SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,761 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects attempts to escalate privileges by modifying Windows service configurations using 'sc.exe' from a non-administrative context (Medium integrity level). Specifically, it looks for modifications to a service's 'binPath' (ImagePath) or 'FailureCommand', which could allow an attacker to execute arbitrary code with elevated privileges when the service starts or fails.
Detects the execution of Accesschk.exe, a Sysinternals utility used for auditing permissions. Adversaries often abuse this tool to discover privileges and access rights on a system, which can aid in privilege escalation or further discovery within the environment.
This rule detects attempts to bypass User Account Control (UAC) using the 'ComputerDefaults.exe' utility, specifically when it is executed with elevated integrity levels (High or System) and not as a child process of common system directories like 'System32' or 'Program Files'. This behavior is characteristic of UAC bypass tools such as UACMe (method 59).
Detects a specific User Account Control (UAC) bypass technique leveraging 'ieinstal.exe' as a parent process. The rule looks for processes with 'High' or 'System' integrity levels, where the parent process is 'ieinstal.exe' and the created process is 'consent.exe' located in a temporary directory ('\AppData\Local\Temp\'). This pattern is characteristic of the UACMe tool's method 64.
This rule detects a specific User Account Control (UAC) bypass technique that involves `pkgmgr.exe` launching `dism.exe` with elevated integrity levels. This behavior is characteristic of UACMe, a tool used to discover and implement UAC bypasses. The rule specifically looks for `dism.exe` being spawned as a child process of `pkgmgr.exe` and operating at 'High' or 'System' integrity levels, or their corresponding Security Identifier (SID) representations.
Detects image load events of system control panel items (.cpl) from uncommon or non-system locations which might be the result of sideloading. This technique can be used for defense evasion by masquerading malicious code as legitimate system components.
This rule detects suspicious child processes spawned by the Windows Print Spooler service (spoolsv.exe) running with System integrity. The detection logic specifically looks for the execution of various Windows utilities and command-line interpreters (like cmd.exe, powershell.exe, net.exe, wmic.exe, certutil.exe, bitsadmin.exe, rundll32.exe, etc.) that are commonly abused by attackers for execution, privilege escalation, or reconnaissance after exploiting vulnerabilities in the Print Spooler service (e.g., PrintNightmare). The rule includes filters to reduce false positives for some commands.
Detects a specific User Account Control (UAC) bypass technique that leverages the 'changepk.exe' and 'slui.exe' executables. This method is associated with UACMe bypass technique #61, where 'slui.exe' is used as a parent process to launch 'changepk.exe' with elevated privileges, bypassing the UAC prompt. The rule specifically looks for 'changepk.exe' being spawned by 'slui.exe' with an integrity level of 'High' or 'System'.
Detects User Account Control (UAC) bypass attempts leveraging NTFS reparse points and wusa.exe DLL hijacking, specifically targeting techniques similar to UACMe method 36. This rule identifies the creation of processes with elevated integrity levels (High or System) executing 'wusa.exe' with a specific command line pattern pointing to a temporary update.msu file, or 'dism.exe' as a parent process launching 'DismHost.exe' with a suspicious command line containing temporary paths.
Detects a User Account Control (UAC) bypass technique leveraging Windows Media Player's `osk.exe` in conjunction with `cmd.exe` and `mmc.exe` to achieve elevated privileges. This specific pattern is associated with UACMe bypass method 32, which exploits the `osksupport.dll` vulnerability. The rule looks for the creation of `osk.exe` from the Windows Media Player directory, followed by `cmd.exe` being launched with a specific parent command line involving `mmc.exe` and `eventvwr.msc`, all while maintaining a high or system integrity level.
Page 376 of 680