SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,739 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility with the "/extract" argument. This method was historically used by malware to extract cabinet files, and while it may still function on older Windows versions, it is generally not a supported or common legitimate use case in modern systems.
Detects the execution of "Extexport.exe", a utility that is part of the Internet Explorer browser. This utility can be abused for DLL sideloading, specifically by loading "mozcrt19.dll", "mozsqlite3.dll", or "sqlite.dll" if a folder is provided in the command line, or arbitrary DLLs if specific flags are used. This behavior is associated with malware like Astaroth and Guildma.
This rule detects when a single rule or all rules have been deleted from the Windows Defender Firewall exception list. This activity can indicate an adversary attempting to impair defenses by removing firewall restrictions to facilitate command and control, lateral movement, or data exfiltration.
Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability. This vulnerability affects 7-Zip version 21.07 and earlier on Windows, allowing privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The rule specifically looks for child processes like cmd.exe, powershell.exe, or pwsh.exe being spawned under the 7zFM.exe process, excluding common command line arguments or file extensions that might indicate legitimate usage.
Detects attempts to bypass AMSI (Antimalware Scan Interface) using .NET reflection. This technique involves manipulating the 'amsiInitFailed' field within 'System.Management.Automation.AmsiUtils' to disable AMSI scanning, often seen in PowerShell scripts to evade detection.
This rule detects when 'sigverif.exe' spawns child processes that are not 'WerFault.exe'. 'sigverif.exe' is a legitimate Windows binary used for verifying file signatures. However, it can be abused as a Living Off the Land Binary (LOLBIN) to proxy execution of other malicious processes, thereby bypassing application whitelisting or other security controls. The rule specifically filters out 'WerFault.exe' as a common and legitimate child process of 'sigverif.exe' to reduce false positives.
Detects the execution of Xwizard.EXE with the "RunWizard" flag and a GUID-like argument, which indicates an attempt to abuse this utility to run custom COM objects created in the registry. This technique is often used for defense evasion.
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed in Microsoft Excel. Threat actors could leverage this to run malicious Python code within Excel without user notification.
Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.
Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths like PerfLogs, Users\Public, Windows\Temp, or Appdata\Local\Temp. This activity can be indicative of malware unpacking or staging.
Page 402 of 680