SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,627 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of Usage Log files by the CLR (clr.dll) for specific system binaries. These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context. This activity can be indicative of defense evasion techniques where adversaries use trusted binaries to proxy execution of malicious code, and the CLR usage logs can reveal this activity.
This rule detects the creation of temporary files in a specific path within the AppData\Local\Temp directory. The path contains a unique hash-like string, which is associated with the PCRE.NET package. This activity could indicate the execution or unpacking of applications that utilize the PCRE.NET library, potentially for malicious purposes such as code execution or payload delivery.
This rule detects suspicious file creation activity involving 'colorcpl.exe'. Specifically, it looks for instances where 'colorcpl.exe' is the image creating files in the 'c:\windows\system32\spool\drivers\color\' directory, excluding common color profile file extensions like '.icm', '.gmmp', '.cdmp', and '.camp'. This behavior is indicative of an adversary attempting to hide malicious files within a legitimate system directory by abusing the color management control panel utility.
Detects the creation of '.diagcab' files, which can be used by legitimate installers but also by adversaries for exploitation or data collection. The rule suggests reviewing the filename and its location for further investigation.
This rule detects the creation of executable files (.exe) within the `C:\Windows\WinSxS\` directory by processes that are not located in standard system directories (`C:\Windows\Systems32\`, `C:\Windows\SysWOW64\`, or `C:\Windows\WinSxS\`). This behavior can be indicative of malware attempting to establish persistence or execute from a less commonly monitored system directory, potentially mimicking legitimate system components.
Detects the creation of a file named 'livekd.dmp' in the 'C:\Windows\' directory, which is the default output file for LiveKD kernel memory dumps. This activity can indicate an attempt to perform live kernel debugging, potentially for privilege escalation or defense evasion purposes.
Detects the creation of Process Explorer drivers by processes other than Process Explorer itself. This activity can indicate that hack tools or malware are attempting to use the Process Explorer driver for privilege escalation, often by dropping the driver to disk, running a service with it, and then removing it.
Detects the creation of a DLL file by "dllhost.exe" in the System32 directory, which is indicative of the "IDiagnosticProfileUAC" UAC bypass technique. This technique leverages a legitimate Windows process to write a malicious DLL into a system directory, allowing for privilege escalation.
Detects a User Account Control (UAC) bypass technique that leverages the Windows Event Viewer (eventvwr.exe). This method involves manipulating the registry to execute an arbitrary binary or script with elevated privileges when eventvwr.exe is launched. The rule specifically looks for file creation events in the 'RecentViews' directory associated with Event Viewer, where the creating process is not a standard system process (i.e., not originating from C:\Windows\System32\ or C:\Windows\SysWOW64\).
Detects the creation of specific files (winsat.exe or winmm.dll) in a user's temporary directory under a 'system32' subdirectory. This pattern is indicative of a User Account Control (UAC) bypass technique that exploits a path parsing vulnerability in winsat.exe, often associated with UACMe (specifically UACMe method 52). The rule looks for files created in 'C:\Users\<username>\AppData\Local\Temp\system32\' with the names 'winsat.exe' or 'winmm.dll'.
Page 531 of 680