SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,613 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects commands that attempt to disable Volume Shadow Copy Service (VSS) diagnostic logging by setting the 'Disabled' flag. This activity is often associated with ransomware or other malware attempting to prevent recovery of encrypted files or to evade forensic analysis.
Detects applications attempting to modify the Windows Registry to disable write protection for storage devices. This activity can precede ransomware attacks or other malicious data manipulation, as observed with certain threat groups.
Detects `regsvr32.exe` execution attempting to download and install DLLs from a remote IP address. This technique is often used for defense evasion and bypassing application control by leveraging a trusted Microsoft binary to execute arbitrary code.
Detects the execution of `regsvr32.exe` to load a DLL hosted on a remote network share. This technique is often used by adversaries for defense evasion and to bypass application control.
Detects attempts to tamper with the PowerShell execution policy by modifying registry keys via the command line. This technique is often used by adversaries to bypass script signing requirements, allowing the execution of unsigned or malicious PowerShell scripts.
Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance. This behavior is often associated with defense evasion techniques, where adversaries use legitimate Windows utilities to execute malicious code or bypass application whitelisting.
This rule detects the execution of Microsoft Office applications (Excel, Access, Publisher, OneNote, Outlook, PowerPoint, Word) when their executable files have been renamed. It identifies processes where the original file name or description indicates an Office application, but the executed image path does not match the standard, legitimate executable name for that application. This technique is often used by adversaries for defense evasion to bypass security controls that monitor known legitimate application names.
This rule detects the execution of the Remote Utilities (RURAT) legitimate remote administration tool when its executable name has been changed from its default names (rutserv.exe or rfusclient.exe). It identifies the tool by inspecting the 'Product' field in the PE header, which contains 'Remote Utilities', and then filters out the known legitimate executable names to catch instances where the file has been renamed, often as a defense evasion technique.
Detects the execution of 'rundll32.exe' when its parent process is 'explorer.exe'. This behavior has been observed in variants of the Raspberry Robin malware, as initially reported by Red Canary. The rule includes filters to reduce false positives from legitimate Windows operations, such as volume control.
This rule detects suspicious workstation locking activity initiated via rundll32.exe. Specifically, it looks for instances where rundll32.exe is the process image, its parent process is cmd.exe, and its command line contains both 'user32.dll,' and 'LockWorkStation'. This combination indicates an attempt to programmatically lock the workstation using a system binary proxy execution method, which can be abused by adversaries.
Page 569 of 680