SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,622 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of the AdvancedRun utility when it attempts to run a process with elevated privileges, specifically in the context of TrustedInstaller, SYSTEM, Local Service, or Network Service accounts. This tool can be used by adversaries for privilege escalation and defense evasion.
Detects the execution of 'csexec.exe', a remote execution tool similar to PsExec. This tool can be used by attackers for lateral movement or remote code execution within a network.
This rule detects the execution of the 'ftp.exe' binary when it has been renamed. Adversaries often rename legitimate system binaries to evade detection by security tools that monitor for specific executable names. The detection logic specifically looks for process creation events where the original filename metadata indicates 'ftp.exe', but the actual image path (the executed file name) is different from 'ftp.exe'. This indicates that the 'ftp.exe' binary has been renamed and then executed.
Detects the execution of a process where the original description is 'Java Update Scheduler' or 'Java(TM) Update Scheduler', but the executable file name is not 'jusched.exe'. This behavior is indicative of an adversary renaming a legitimate utility to evade detection, a technique known to be used by groups like Cobalt Group.
Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries. This technique is often used for defense evasion by proxying execution of malicious content with a trusted, signed binary.
This rule detects the creation of processes from unusual and potentially suspicious locations on a Windows system. Specifically, it looks for executables being run from the 'RECYCLER' directory, 'SystemVolumeInformation' directory, or various subdirectories within 'C:\Windows\' that are not typically used for executable storage, such as 'Tasks', 'debug', 'fonts', 'help', 'drivers', 'addins', and 'cursors'. Adversaries often use these locations to hide malicious executables and evade detection.
This rule detects attempts to coerce NTLM authentication on the Printer Spooler service, which can be used for privilege escalation. Specifically, it looks for `rundll32.exe` executing with command-line arguments related to `davclnt.dll,DavSetCookie` and keywords like `spoolss`, `srvsvc`, or `/print/pipe/`, indicating an NTLM relay attack against the print spooler service.
Detects potential abuse of "ShellDispatch.dll" functionality to execute arbitrary binaries via "ShellExecute" using rundll32.exe. This technique involves rundll32.exe being executed with a command line containing 'RunDll_ShellExecuteW'.
This rule detects suspicious execution of rundll32.exe when its parent process is control.exe, specifically excluding cases where 'Shell32.dll' is present in the command line. This behavior has been observed in attacks by the Equation Group and exploit kits to load malicious DLLs via the Control Panel process, often as a defense evasion technique.
Detects the execution of Rundll32.exe where the command line contains file extensions commonly associated with image files. This behavior is suspicious as Rundll32.exe is typically used to execute DLL functions, and its use with image file extensions can indicate an attempt to masquerade malicious DLLs or scripts as benign image files to evade detection.
Page 545 of 680