SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,627 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when Windows developer features like "Developer Mode" or "Application Sideloading" are enabled by modifying specific registry keys. This allows users to install untrusted packages, potentially bypassing code signing requirements and enabling the execution of malicious applications.
This rule detects a User Account Control (UAC) bypass technique that leverages the Windows Event Viewer (eventvwr.exe). Specifically, it looks for modifications to the registry key `\mscfile\shell\open\command`. This registry key is associated with how .msc files (Microsoft Management Console snap-ins) are opened. By manipulating this key, an attacker can hijack the execution flow when eventvwr.exe is launched, causing it to execute an arbitrary command with elevated privileges without a UAC prompt. This is a known method for privilege escalation and defense evasion.
Detects when the 'AllowMultipleTSSessions' registry value is enabled, which allows for multiple Remote Desktop Protocol (RDP) sessions to be opened concurrently. Attackers often leverage this to maintain access to an RDP session without disconnecting other legitimate users, facilitating persistence and potentially defense evasion.
Detects "GoogleUpdate.exe" spawning a new instance of itself in an uncommon location, a technique used by the Goofy Guineapig backdoor to evade detection. The rule specifically looks for instances where both the parent and child process images are named 'GoogleUpdate.exe', but the child process is not located in standard Google installation or update paths.
This rule detects the creation of a new Windows service (EventID 7045 from 'Service Control Manager') where the service's ImagePath contains specific PowerShell commands indicative of Invoke-Obfuscation's COMPRESS obfuscation technique. Specifically, it looks for the presence of 'new-object', 'text.encoding]::ascii', 'readtoend', and either ':system.io.compression.deflatestream' or 'system.io.streamreader' within the ImagePath. This combination suggests an attempt to decompress and execute obfuscated PowerShell code as part of a service.
Detects the creation of a new service where the ImagePath contains 'rundll32' and 'shell32.dll' along with obfuscation indicators like '&&', 'value', 'invoke', 'comspec', or 'iex'. This pattern is often used by adversaries to execute obfuscated PowerShell commands via rundll32, specifically leveraging 'shellexec_rundll'.
Detects DNS queries for the domain "anonfiles.com", which is an anonymous file upload platform often used by adversaries for malicious purposes, including data exfiltration. This rule specifically looks for any DNS query containing '.anonfiles.com'.
Detects the creation of memory dump files (.dmp, .hdmp) by common scripting or shell applications such as cmd.exe, powershell.exe, cscript.exe, mshta.exe, pwsh.exe, or wscript.exe. Memory dumps can contain sensitive information like credentials, and their creation by these processes can be indicative of malicious activity, especially if not tied to a legitimate crash.
This rule detects the creation of a dump file by the password dumper tool QuarksPwDump. Specifically, it looks for files created in the 'AppData\Local\Temp\' directory with names starting with 'SAM-' and ending with '.dmp'. This pattern indicates that QuarksPwDump is attempting to dump the Security Account Manager (SAM) database, which contains local user credentials.
Detects the creation of specific output files generated by the built-in Windows reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs". This script is known to be used by adversaries for system and network information discovery.
Page 530 of 680