SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,763 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects a specific User Account Control (UAC) bypass technique known as "IDiagnosticProfileUAC". This technique involves a process with high or system integrity level launching 'DllHost.exe' with a specific command-line argument containing '{12C21EA7-2EB8-4B55-9249-AC243DA8C666}'. This behavior is indicative of an attempt to elevate privileges by bypassing UAC.
This rule detects a User Account Control (UAC) bypass technique that exploits a path parsing vulnerability in `winsat.exe`. Specifically, it looks for the creation of a process with 'High' or 'System' integrity levels where the parent process image path ends with `\AppData\Local\Temp\system32\winsat.exe` and the parent command line contains `C:\Windows \system32\winsat.exe`. This pattern is indicative of UACMe method 52, which leverages a specially crafted path to trick `winsat.exe` into executing an arbitrary payload with elevated privileges.
Detects the execution of SharpMove, a .NET utility used for lateral movement that performs tasks such as task creation, Service Control Manager (SCM) queries, and VBScript execution via WMI. The detection is based on the executable name or original filename and the presence of specific command-line arguments indicating its functionality.
Detects the modification of the system's code page to Russian language (code page 1251 or 866) using the `mode.com` utility. This activity has been observed in attacks involving Dharma ransomware and other malware.
Detects modifications to the "Default" value of specific 'MyComputer' registry keys and their subkeys. This technique can be used by adversaries to establish persistence by pointing to a custom binary that will be launched when an associated action (e.g., opening 'My Computer') is executed. This method leverages less common registry locations for persistence compared to standard Run keys.
Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.
Detects the execution of Fast Reverse Proxy (FRP) client or server binaries, or command-line arguments indicative of FRP configuration files. FRP is a legitimate tool that can be used by adversaries to establish command and control (C2) channels by exposing local services behind NAT or firewalls to the internet, effectively creating a proxy.
Detects the execution of PAExec, a legitimate remote administration tool, when its executable name has been changed from the default 'PAExec.exe'. Adversaries often rename legitimate tools like PAExec to evade detection by security products that might flag the original executable name. The rule identifies PAExec based on its internal metadata (Description, OriginalFileName, Product) or specific IMPHASH values, and then filters out instances where the executable retains its original name or is executed from a known PAExec-specific directory created by the tool itself (e.g., C:\Windows\PAExec-XXXXX-ComputerName). This helps to focus on suspicious renamed executions.
This rule detects the creation of a named file stream (Alternate Data Stream - ADS) containing specific Imphash values associated with known hack tools. The Imphash values are for tools such as Mimikatz, PetitPotam, JuicyPotato, RoguePotato, Pwdump, Cobalt Strike beacons, NanoDump, HandleKatz, DripLoader, UACMe, Dumpert, EDRSandBlast, and others. Adversaries often use ADSs to hide malicious executables or data to evade detection by traditional security tools that may not scan alternate data streams.
Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.
Page 378 of 680