SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,631 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects instances where 'rundll32.exe' is executed without any command-line parameters. This behavior has been observed in the context of Metasploit's windows/smb/psexec exploit module, where rundll32.exe is used to proxy execution of malicious code. Legitimate uses of rundll32.exe typically involve specific DLL and function arguments.
This rule detects suspicious child processes spawned by Electron-based applications such as Microsoft Teams, Discord, Slack, GitHub Desktop, Keybase, and web browsers like Edge. The detection logic focuses on the creation of common command-line interpreters and scripting engines (e.g., cmd.exe, powershell.exe, cscript.exe, wscript.exe, mshta.exe, regsvr32.exe, whoami.exe) or execution from suspicious temporary or user-writable paths (e.g., ProgramData, Temp, AppData\Local\Temp, Users\Public). This behavior could indicate `.asar` file tampering, where an attacker modifies the application's bundled resources to execute malicious code, or the use of these legitimate applications as execution proxies for arbitrary commands. The rule specifically filters out a known legitimate Discord behavior involving `cmd.exe` and `nvidia-smi.exe` to reduce false positives.
This rule detects the presence of a Base64 encoded MZ header within a command line. The MZ header is characteristic of Windows executable files. Its appearance in a command line, especially in a Base64 encoded format, often indicates an attempt to execute malicious code or a payload that has been obfuscated to evade detection. This technique is commonly used by attackers to deliver and execute malware.
This rule detects suspicious network scanning activity by identifying command-line executions that combine looping constructs ('for', 'foreach') with network discovery tools ('nslookup', 'ping'). This pattern is often used by adversaries to enumerate systems on a network for lateral movement or further reconnaissance.
Detects the pattern of User Account Control (UAC) Bypass using the ICMLuaUtil Elevated COM interface. This technique involves a specific parent process (dllhost.exe) launching with particular Process IDs associated with the ICMLuaUtil interface, which can be abused to elevate privileges without user interaction. The rule filters out legitimate WerFault.exe processes to reduce false positives.
This rule detects the use of 'w32tm.exe' with specific command-line arguments that allow it to act as a delay mechanism. Adversaries may leverage this legitimate Windows utility to introduce delays in their execution, potentially for sandbox evasion or to time their activities. The detected command-line arguments include '/stripchart', '/computer:', '/period:', '/dataonly', and '/samples:'.
Detects the execution of 'wermgr.exe' from an unusual or suspicious file path. Legitimate 'wermgr.exe' executions typically originate from 'C:\Windows\System32\', 'C:\Windows\SysWOW64\', or 'C:\Windows\WinSxS\'. Adversaries may rename or move legitimate Windows binaries to evade detection or blend in with normal system activity.
Detects the creation or modification of registry keys related to printer drivers that contain specific strings associated with Mimikatz or the PrinterNightmare vulnerability (CVE-2021-1675, CVE-2021-34527). The rule looks for 'QMS 810' or 'mimikatz' in printer driver paths, or a combination of 'legitprinter' and printer environment paths, or specific strings like 'Gentil Kiwi', 'mimikatz printer', or 'Kiwi Legit Printer' in registry objects related to printing.
Detects when an attacker modifies the 'Debugger' value within the 'AeDebug' registry key to establish persistence. This mechanism ensures that a specified malicious executable or DLL is launched whenever an application crashes, providing a persistent foothold on the system.
Detects attempts to disable Windows Defender Tamper Protection by modifying the relevant registry key. Tamper Protection is a security feature that prevents malicious programs from changing important security settings.
Page 529 of 680