SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,634 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects when the Sysmon service crashes, indicated by an 'Application Popup' event with EventID 26 and a caption explicitly mentioning 'sysmon.exe - Application Error' or 'sysmon64.exe - Application Error'. This could signify an attempt to impair or disable Sysmon, which is a critical defense mechanism for endpoint monitoring.
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name (SAM or SECURITY) located in the temporary directory have been reset. This behavior can occur when an application attempts to access a hive that has not been recognized for a period (default 7 days). Registry hive dumping utilities such as QuarksPwDump have been observed to exhibit this behavior, which is often associated with credential dumping.
Detects the creation of a new Windows service where the ImagePath contains highly obfuscated PowerShell commands. Specifically, it looks for 'cmd' executing a 'set' command to define an environment variable, followed by PowerShell execution with the '-f' format operator, which is characteristic of Invoke-Obfuscation's VAR+ launcher technique. This method uses environment variables and string manipulation to hide malicious PowerShell code.
This rule detects the creation of a new Windows service (EventID 7045 from 'Service Control Manager') where the 'ImagePath' contains patterns indicative of obfuscated PowerShell execution via standard input (stdin). Specifically, it looks for the presence of 'set' and '&&' along with keywords like 'environment', 'invoke', or 'input' within the service's executable path, suggesting an attempt to execute obfuscated commands.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory, which is a common technique used by attackers to steal credentials. The detection is specifically triggered by Windows Defender's Attack Surface Reduction (ASR) rule for blocking credential stealing from LSASS, indicated by EventID 1121 and the target path ending with '\lsass.exe'. The rule includes filters to reduce false positives from legitimate processes that might interact with LSASS.
Detects when Microsoft Defender for Endpoint blocks process creations originating from PSExec or WMI commands. This rule specifically looks for Event ID 1121 (Attack Surface Reduction rule blocked action) where the process name ends with 'wmiprvse.exe' (WMI Provider Host) or 'psexesvc.exe' (PsExec service). This indicates that an ASR rule designed to prevent execution via these methods has been triggered and successfully blocked the action.
Detects when the Windows Defender antivirus scanning feature is disabled, indicated by Event ID 5012 from the WinDefend service. This action is often performed by adversaries to impair defenses and avoid detection.
Detects the download of a file with a potentially suspicious extension from a .zip top-level domain. This rule specifically looks for the creation of alternate data streams (ADS) containing a 'Zone.Identifier' indicating a download from a '.zip' TLD, combined with suspicious file extensions commonly used for malicious payloads.
Detects DNS queries initiated by 'Regsvr32.exe'. This activity is suspicious as 'Regsvr32.exe' is a legitimate Windows utility used to register and unregister DLLs, but it is often abused by adversaries for proxy execution, defense evasion, and bypassing application control. A DNS query from this process could indicate an attempt to resolve a malicious domain for command and control or payload retrieval.
This rule detects the deletion of Windows Event Log (EVTX) files. Adversaries often delete these logs to remove forensic evidence of their activities, making it harder for defenders to investigate and understand the scope of a compromise. The rule specifically looks for file deletion events where the target filename starts with 'C:\Windows\System32\winevt\Logs\' and ends with '.evtx', which are the standard locations and extensions for Windows Event Log files.
Page 516 of 680