SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,479 copies16 likes159,603 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of 'InfDefaultInstall.exe' with an '.inf' file specified on the command line. This behavior is commonly abused by adversaries to proxy execution of malicious code, often to bypass application whitelisting or other security controls. The tool 'InfDefaultInstall.exe' is a legitimate Windows binary used to install INF files, but it can be leveraged to execute commands embedded within a specially crafted INF file, including SCT scripts via 'scrobj.dll'.
This rule detects attempts to change the password for the currently logged-on user using the 'ksetup.exe' utility. The detection specifically looks for the execution of 'ksetup.exe' with the '/ChangePassword' command-line argument. This activity could indicate an attacker attempting to modify user credentials on a compromised system.
Detects the execution of "ldifde.exe" to export Active Directory structure. This tool is often used by attackers to collect information about the domain for reconnaissance or exfiltration purposes. The rule specifically looks for the execution of ldifde.exe with the '-f' flag, which indicates an output file, while excluding the '-i' flag which is used for importing data.
This rule detects the execution of "LINK.EXE" with an uncommon parent process. LINK.EXE is a Microsoft incremental linker, typically bundled with Visual Studio. Other utilities like editbin.exe, dumpbin.exe, and lib.exe often hardcode calls to "LINK.EXE" without validating its path. This behavior can be exploited by an attacker to sideload a malicious binary named "link.exe" if one of these legitimate tools is executed from an unexpected location. The rule filters out known legitimate parent processes from Visual Studio installation paths to identify suspicious executions.
This rule detects when 'devtoolslauncher.exe' is executed with the 'LaunchForDeploy' command-line argument. This behavior is indicative of 'devtoolslauncher.exe' being used to proxy the execution of another binary, which can be abused by adversaries for defense evasion.
This rule detects suspicious execution of 'extrac32.exe' when it is used to download or copy files, specifically cabinet (.cab) files, with common extraction options. Extrac32.exe is a legitimate Windows utility for extracting files from cabinet archives, but it can be abused by adversaries for ingress tool transfer or to stage malicious files.
Detects code execution where PowerShell (powershell.exe or pwsh.exe) is the parent process and its command line contains references to the Pester module, specifically when Pester is used to invoke other commands or scripts. This could indicate an adversary leveraging Pester for execution, potentially for defense evasion or to bypass security controls.
Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application. This technique can be used by adversaries for defense evasion by proxying execution of malicious content with a trusted binary.
Detects the use of a Microsoft signed script, UtilityFunctions.ps1, executing a managed DLL with PowerShell. This technique can be used by adversaries to bypass application control and signature validation.
This rule detects the execution of 'VisualUiaVerifyNative.exe', a legitimate Microsoft Windows SDK tool. This executable has been identified as a potential method for bypassing Application Whitelisting (AWL) solutions like Windows Defender Application Control (WDAC) and is included in Microsoft's recommended block rules for such bypasses. Adversaries may abuse this signed binary to proxy execution of malicious code, thereby evading defenses.
Page 580 of 680