SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,632 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of the default CSExec service executable file, 'csexecsvc.exe', which indicates the installation and potential execution of the CSExec service. CSExec is a tool similar to PsExec, used for remote command execution.
Detects the creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory. This file can be used as a persistence mechanism because its content is executed whenever certain tools under "C:\WINDOWS\System32\oobe\" (e.g., Setup.exe) fail to run.
Detects the creation of recent file shortcuts (.lnk) that point to disk image files (.iso, .img, .vhd, .vhdx). This activity is often observed in phishing attacks where adversaries use these file types to deliver malware. The rule specifically looks for these shortcuts within the 'Recent' folder of a user's profile, indicating that the user has recently interacted with such a file.
Detects the creation of files with the '.pub' extension (Microsoft Publisher documents) in suspicious or uncommon locations such as temporary directories or public user folders. This activity could indicate an attacker abusing Publisher documents for malicious purposes, potentially as part of defense evasion or initial access.
This rule detects the creation of Microsoft Office files (Word documents, Excel spreadsheets) within the default startup folders for Microsoft Word and Excel. This technique can be used by adversaries to establish persistence, as these files will automatically execute or load when the respective Office application is launched. The rule specifically looks for file creations in paths containing '\Microsoft\Word\STARTUP' or '\Microsoft\Excel\XLSTART', and also considers paths containing both '\Office' and '\Program Files' along with '\STARTUP' or '\XLSTART'. It filters out legitimate creations by the Office applications themselves (WINWORD.exe, EXCEL.exe) to reduce false positives.
This rule detects the creation of a file named 'RemComSvc.exe', which is the default service executable name used by the RemCom utility. The presence of this file typically indicates the installation and execution of RemCom on a Windows system, often for remote administration or malicious purposes.
Detects the creation of a suspicious file by 'svchost.exe' in the 'Personalization\LockScreenImage' directory, specifically looking for files that are not in the 'C:\Windows\' directory and do not have common image extensions like '.jpg', '.jpeg', or '.png'. This behavior can indicate an adversary attempting to download or stage malicious files using the 'desktopimgdownldr' functionality, which is often associated with T1105 (Ingress Tool Transfer).
This rule detects when specific legitimate Windows applications, including Microsoft Office programs, LOLBINs (Living Off the Land Binaries), and other common executables, create new executable files (.exe, .dll, .ocx) on disk. This behavior is often indicative of malicious activity, such as malware dropping payloads or using trusted processes to evade detection.
Detects the creation of the LiveKD driver (LiveKdD.SYS) by any process other than the legitimate LiveKD executables (livekd.exe or livek64.exe). This could indicate an attempt to load a malicious or unauthorized driver using a renamed or masqueraded process.
Detects the creation of the default PsExec service executable file, 'PSEXESVC.exe', which is indicative of PsExec being used to install and execute a service on a system.
Page 524 of 680