SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,763 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects User Account Control (UAC) bypass attempts leveraging NTFS reparse points and wusa.exe DLL hijacking, specifically targeting techniques similar to UACMe method 36. This rule identifies the creation of processes with elevated integrity levels (High or System) executing 'wusa.exe' with a specific command line pattern pointing to a temporary update.msu file, or 'dism.exe' as a parent process launching 'DismHost.exe' with a suspicious command line containing temporary paths.
Detects a User Account Control (UAC) bypass technique leveraging Windows Media Player's `osk.exe` in conjunction with `cmd.exe` and `mmc.exe` to achieve elevated privileges. This specific pattern is associated with UACMe bypass method 32, which exploits the `osksupport.dll` vulnerability. The rule looks for the creation of `osk.exe` from the Windows Media Player directory, followed by `cmd.exe` being launched with a specific parent command line involving `mmc.exe` and `eventvwr.msc`, all while maintaining a high or system integrity level.
Detects the creation of a binary file with the ".sed" extension. The ".sed" extension stand for Self Extraction Directive files.
These files are used by the "iexpress.exe" utility in order to create self extracting packages.
Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
Usually ".sed" files are simple ini files and not PE binaries.
These files are used by the "iexpress.exe" utility in order to create self extracting packages.
Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
Usually ".sed" files are simple ini files and not PE binaries.
Detects suspicious usage of the ShellExec_RunDLL function to launch other commands, as observed in the Raspberry Robin attack. This rule specifically looks for 'ShellExec_RunDLL' in the command line combined with suspicious paths or commands like 'Desktop', 'Temp', 'Users\Public', 'comspec', 'iex', 'Invoke-', 'msiexec', 'odbcconf', or 'regsvr32'.
This rule detects the creation of a 'conhost.exe' process running with high integrity (elevated privileges) and using the '-ForceV1' and '0xffffffff' command-line options. This combination can be indicative of an attempt to bypass security controls or execute commands indirectly, as 'ForceV1' requests information directly from the kernel space and 'conhost' connects to the console application. This behavior has been observed in campaigns like Conti ransomware.
Detects a specific pattern indicative of a User Account Control (UAC) bypass technique using DismHost DLL hijacking. This method, often associated with UACMe (specifically UACMe 63), involves a process named 'DismHost.exe' being launched from a user's temporary directory with elevated integrity levels (High or System). This behavior is suspicious because DismHost.exe is a legitimate Windows component, but its execution from a temporary user-specific path with elevated privileges suggests an attempt to bypass UAC.
Detects a specific UAC bypass technique involving the modification of the msconfig token, often associated with tools like UACMe (specifically method 55). The rule looks for a process with High or System integrity level, whose parent process is 'pkgmgr.exe' located in a temporary directory, and executes 'msconfig.exe' with the '-5' command-line argument.
This rule detects the execution of 'sdclt.exe' with elevated privileges (High integrity level). This behavior is often indicative of an attempt to bypass User Account Control (UAC) mechanisms on Windows systems. Attackers may leverage sdclt.exe, a legitimate Windows utility, to execute arbitrary commands or processes with administrative rights without triggering a UAC prompt.
This rule detects the use of "hh.exe" to download or execute remotely hosted Compiled HTML Help (.chm) files. Adversaries may abuse hh.exe, a legitimate Windows utility, to bypass application control or execute malicious code by loading CHM files from remote HTTP/HTTPS or UNC paths. This technique can be used for defense evasion and initial access.
Detection rule generated by AI system
Page 377 of 680