SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,625 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.
Detects the execution of various scripting interpreters or command-line tools via a LNK file accessed from a WebDAV share. This technique is often used by adversaries to bypass security controls and execute malicious code, leveraging the `DavWWWRoot` path to indicate WebDAV access. The parent process is expected to be `explorer.exe`, suggesting user interaction.
Detects changes to the Windows Registry that configure a monitor program to dump the memory of the lsass.exe process using the SilentProcessExit technique. This method leverages Image File Execution Options (IFEO) to trigger a memory dump of LSASS when it exits, which can be used to extract credentials.
Detects the abuse of the 'exefile' handler in new file associations within the Windows Registry. This technique can be used by adversaries to bypass security products by associating a malicious executable with a common file extension, causing the malicious executable to run when a user interacts with that file type.
Detects potential persistence by monitoring for modifications to the Excel Options registry key, specifically looking for the addition of an Excel Add-in (XLL) file that would cause it to run automatically when Excel starts. This technique is often used by adversaries to maintain access to a compromised system.
This rule detects error messages generated by Sysmon when it fails to open its service configuration or connect to its driver to update the configuration. These errors can indicate an adversary's attempt to tamper with or disable Sysmon logging to evade detection. The rule specifically filters out known false positives related to write-protected media or specific error codes (19, 93) to reduce noise.
Detects when an attacker attempts to disable or modify Sysmon's configuration to evade detection. This rule specifically looks for Sysmon's state changing to 'Stopped' or a 'Sysmon config state changed' event occurring when Sysmon was not already in a 'Started' state.
This rule detects the creation of a file named 'lsass.exe.dmp' within the 'C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\' directory. This specific file pattern and location are indicative of an attempt to dump the LSASS process memory, which often contains sensitive credential material. Adversaries frequently use this technique to extract credentials for lateral movement or persistence. The rule specifically references the 'LSASS Shtinkering' technique, which abuses Windows Error Reporting to achieve LSASS memory dumping.
Detects the creation of suspicious binary files (DLL, EXE, SYS) within the `C:\Windows\System32\spool\drivers\color\` directory. This activity has been observed in attacks by threat actors, such as those described in the referenced Microsoft blog, where it's used for defense evasion or persistence by dropping malicious payloads in a trusted system directory.
Detects the creation of the LiveKD driver file (LiveKdD.SYS) by the LiveKD or LiveK64 executables. LiveKD is a tool used for live kernel debugging, which can be leveraged by adversaries for defense evasion or privilege escalation by interacting directly with the kernel.
Page 538 of 680