SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,641 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation of new Windows services with suspicious or uncommon image paths. It specifically looks for paths containing references to named pipes, common temporary directories like `Users\Public\` or `Windows\Temp\`, or image paths that include patterns indicative of encoded PowerShell commands (e.g., `-e` followed by specific base64 encoded strings). This behavior is often associated with adversaries establishing persistence or escalating privileges by creating malicious services.
This rule detects the termination of important Windows services, such as antivirus, firewall, Microsoft Defender components, BitLocker, and Encrypting File System (EFS). It specifically looks for Event ID 7023 from the 'Service Control Manager' provider, indicating a service termination with an error. The rule identifies critical services by their display names (which can be language-specific) or by their wide hex-encoded service names in the 'Binary' field of the event.
Detects the installation of a new Windows service where the executable path contains suspicious patterns, specifically executables located directly under 'ProgramData' or the root of the C: drive with a short, potentially obfuscated name (e.g., 'C:\ProgramData\.{1,9}\.exe' or 'C:\.{1,9}\.exe'). This pattern is often used by malware for persistence and to evade detection by hiding in less common locations.
Detects when the grace period for Windows Defender expires, indicating that protection against viruses, spyware, and other potentially unwanted software is disabled. This event suggests a critical security control has been impaired.
Detects when an attempt is made to add or remove applications or folders from Windows Defender Exploit Guard's "ProtectedFolders" or "AllowedApplications" configurations. This could indicate an adversary trying to bypass Controlled Folder Access protections.
Detects when the 'Automatic Sample Submission' feature of Windows Defender is disabled. This is indicated by a change in the antimalware platform configuration, specifically setting the 'SubmitSamplesConsent' registry value to '0x0'. Adversaries may disable this feature to prevent security products from submitting malicious samples for analysis, thereby hindering detection and analysis efforts.
This rule detects when Windows Defender logs the deletion of its malware detection history. This action can be performed by an attacker to remove traces of their activity or to prevent the system from reporting previously detected malware.
Detects when the Windows Defender feature for scanning malware and potentially unwanted software is disabled. This is indicated by Event ID 5010 from the WinDefend service.
This rule detects attempts by PowerShell processes (powershell.exe or pwsh.exe) to create a remote thread in the Local Security Authority Subsystem Service (LSASS) process. This activity is a common technique used by adversaries to dump credentials from memory.
Detects DNS queries made by "AppInstaller.EXE" when attempting to load or install an AppX package from a referenced URL. This activity is indicative of the AppInstaller being used, which is the default handler for the "ms-appinstaller" URI scheme. This can be abused by adversaries for ingress tool transfer.
Page 506 of 680