SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,763 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the loading of 'EvtMuteHook.dll' based on its unique IMPHASH. This DLL is a component of SharpEvtHook/EvtMute, a tool designed to tamper with Windows event logs to evade detection. The rule specifically looks for the known IMPHASH of this malicious DLL.
This rule detects the creation of processes with specific SHA1 or SHA256 hashes that have been identified as indicators of compromise (IOCs) associated with the GALLIUM cyber espionage group. These hashes correspond to known malicious executables used by the group. The detection is based on a report by Microsoft Threat Intelligence Center from December 2019, which detailed GALLIUM's targeting of global telecommunications.
Detects the loading of specific malicious DLLs (ffmpeg.dll, d3dcompiler_47.dll, and an ICONIC Stealer payload) that were identified as compromised and used in attacks involving the 3CXDesktopApp. This rule uses SHA256, SHA1, and MD5 hashes to identify the malicious DLLs.
Detects when an access policy that is applied to a GCP cloud resource is deleted.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
Detects the execution of Process Hacker, a tool used to view and manipulate processes and other low-level system options. Detection is based on binary metadata such as image path, original filename, description, product name, and known file hashes (MD5, SHA1, SHA256, IMPHASH). Threat actors have been known to abuse older, vulnerable versions of Process Hacker to manipulate system processes.
Detects the execution of UACMe, a tool used for User Account Control (UAC) bypasses, by identifying specific PE metadata (Product, Company, Description, OriginalFileName) or image names. It also includes a selection of known IMPHASH values associated with UACMe's 'Akagi' component.
Detects the execution of known compromised versions of the 3CXDesktopApp by matching specific file hashes (SHA256, SHA1, MD5) or by identifying the executable name, original filename, and product name, potentially combined with a specific file version. This rule aims to identify instances of the supply chain attack that affected 3CXDesktopApp.
Detects the execution of PCHunter, a powerful system utility similar to Process Hacker, which can be used to view and manipulate processes, kernel options, and other low-level system aspects. Its use by unauthorized personnel can indicate malicious activity, system reconnaissance, or attempts to tamper with system internals.
Detects the execution of the 'Impersonate' tool, which is designed to manipulate Windows tokens. This tool can be used to escalate privileges by impersonating other user tokens, either remotely (e.g., via PsExec/WmiExec) or interactively. Detection is based on specific command-line arguments or known hashes of the tool.
Detects the execution of System Informer, a legitimate but powerful task manager tool that can be used to view and manipulate processes, kernel options, and other low-level operations. Its capabilities make it a potential tool for adversaries to gain system information, escalate privileges, or evade defenses.
Page 379 of 680