SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,662 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation of screensaver files (.scr) in locations outside of standard Windows system directories. Attackers often leverage .scr files, which are essentially executable files, to deliver and execute malicious payloads. By filtering out common legitimate system paths, the rule aims to identify suspicious instances where an .scr file might be dropped or created by an adversary, potentially as part of a defense evasion or execution technique. The rule's description specifically mentions the use of "rundll32.exe desk.cpl,InstallScreenSaver" as an example of how an attacker might execute such a file.
Detects the creation of a specific DLL file ('api-ms-win-core-kernel32-legacy-l1.DLL') within a user's temporary directory. This pattern is indicative of a User Account Control (UAC) bypass technique that leverages NTFS reparse points and DLL hijacking, often associated with tools like UACMe (specifically UACMe 36). The rule looks for the exact file path in a user's AppData\Local\Temp directory.
This rule detects a specific User Account Control (UAC) bypass technique leveraging the Windows Media Player component. Specifically, it looks for the creation of a file named 'OskSupport.dll' within a user's temporary directory, combined with 'DllHost.exe' accessing 'osk.exe' located in the Windows Media Player directory. This pattern is indicative of the UACMe tool's method 32, which exploits a vulnerability related to Windows Media Player to elevate privileges without user interaction.
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). This database contains sensitive information used to sign SAML tokens. The rule specifically looks for connections to the '\MICROSOFT##WID\tsql\query' named pipe by processes other than known legitimate AD FS or Windows Internal Database components.
Detects the execution of PowerShell via the creation of a named pipe starting with 'PSHost'. This method can be used by adversaries to execute PowerShell commands or scripts, potentially bypassing traditional PowerShell logging mechanisms.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects the execution of ADRecon.ps1, a PowerShell script used for Active Directory reconnaissance. The rule identifies specific function names and a default report filename commonly found within the ADRecon script. This tool has been reported to be actively used by the FIN7 threat group.
This rule detects the execution of the PowerShell cmdlet 'Remove-ADGroupMember' with parameters '-Identity' and '-Members'. This cmdlet is used to remove one or more members from an Active Directory group. In the context of this rule, it specifically targets the removal of an account from the 'Domain Admins' group, which could be an adversary's attempt to inhibit access to critical accounts or to clean up their tracks after gaining access.
Detects the execution of non-standard or uncommon assistive technology applications via "AtBroker.exe". AtBroker.exe is a legitimate Windows binary that can be abused to proxy the execution of other programs, often for defense evasion or persistence. This rule specifically looks for instances where AtBroker.exe is used to start applications that are not part of the common, built-in Windows assistive technologies.
Detects the use of 'cdb.exe', a legitimate Windows debugger, to execute arbitrary processes or commands. This technique is often used by adversaries to bypass application whitelisting or execute malicious code through a trusted binary. The rule specifically looks for command-line arguments indicative of debugger script execution ('-c' or '-cf').
Page 486 of 680