SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,631 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the loading of unsigned dbghelp.dll or dbgcore.dll, which are DLLs used for creating memory dumps. This activity is suspicious as these DLLs are often leveraged by attackers, for example, to dump credentials from processes like LSASS using the MiniDumpWriteDump API. Tools like ProcessHacker and the SilentTrinity C2 Framework are known to use this technique.
Detects processes loading modules related to the PCRE.NET package, specifically looking for a unique temporary path often associated with its deployment. This could indicate the execution of code leveraging this package, potentially for malicious purposes like regular expression-based obfuscation or payload delivery.
This rule detects the loading of 'sdiageng.dll' by 'msdt.exe'. This specific combination is known to be exploited by vulnerabilities such as CVE-2022-30190 (Follina) and DogWalk, which leverage msdt.exe for arbitrary code execution by loading a diagnostic library.
Detects the loading of DLLs associated with the Time Travel Debugging (TTD) utility. Adversaries can leverage TTD, specifically `tttracer.exe`, to execute malicious processes or dump sensitive process memory, such as that of `lsass.exe`, for credential access. This rule focuses on the dynamic loading of TTD-related DLLs, indicating potential use of the utility.
Detects a potential DLL hijack involving 'iertutil.dll' when loaded by 'iexplore.exe' within the context of the DCOM InternetExplorer.Application Class. This could indicate an adversary attempting to execute malicious code by manipulating the DLL search order or substituting a legitimate DLL.
This rule detects outbound network connections initiated by the `cmstp.exe` process. `cmstp.exe` is the Microsoft Connection Manager Profile Installer, and it is uncommon for this legitimate binary to initiate outbound network connections. Such activity could indicate an adversary is abusing `cmstp.exe` to proxy execution of malicious code, potentially for defense evasion or UAC bypass, by loading malicious INF files or scriptlets from remote servers.
Detects suspicious network connections initiated by specific Windows binaries (regsvr32.exe, rundll32.exe, dllhost.exe) when they are executed without any command-line parameters. This behavior can indicate an attempt to evade detection by leveraging legitimate system binaries for malicious network communication, potentially associated with malware like Raspberry Robin.
Detects the creation of named pipes with specific patterns known to be used by Cobalt Strike's malleable C2 profiles. This rule identifies common pipe names and patterns associated with Cobalt Strike's inter-process communication, including generic profiles and those related to catalog change listeners.
Detects the WMI Event Consumer service process (scrcons.exe) creating a named pipe. This activity can be indicative of WMI persistence mechanisms being used by adversaries, often in conjunction with named pipes for inter-process communication or command and control.
This rule detects the initiation of a remote PowerShell session by looking for specific strings in PowerShell Classic logs. Specifically, it identifies events where 'HostName=ServerRemoteHost' and 'wsmprovhost.exe' are present in the log data, indicating that a remote host is interacting via Windows Remote Management (WinRM) to execute PowerShell commands.
Page 525 of 680