SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,479 copies16 likes159,603 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the usage of 'wsudo.exe', a Windows Sudo Utility, when it attempts to execute programs with elevated permissions such as 'System' or 'TrustedInstaller'. This tool allows users to run commands with different privileges, which can be abused for privilege escalation.
Detects the creation of a process named 'rasdial.exe'. This executable is used to establish and manage dial-up network connections, but can also be abused by adversaries for various purposes, including establishing C2 communication or exfiltration channels, or for defense evasion by creating unexpected network connections.
This rule detects the execution of Regasm.exe or Regsvcs.exe from suspicious directories. Adversaries often abuse these legitimate Windows utilities to proxy execution of malicious code, particularly for defense evasion. By monitoring their execution from uncommon locations like temporary folders or user-writable directories, this rule aims to identify potential malicious activity that leverages these binaries for purposes such as bypassing application control or achieving persistence.
Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.
Detects the execution of regsvr32.exe with command-line arguments that indicate an attempt to download or register DLLs from remote HTTP or FTP servers. This technique is often used for defense evasion and to bypass application whitelisting by leveraging a legitimate Windows binary to execute malicious code.
This rule detects the execution of `regsvr32.exe` when the DLL it attempts to register or unregister is located in highly suspicious directories. These directories are typically not used for legitimate `regsvr32` operations and can indicate an attempt to evade defenses or execute malicious code from an unusual location. The rule specifically looks for `regsvr32.exe` being executed with a command line that includes paths such as `PerfLogs`, `Temp`, various `Windows\System32` subdirectories not commonly used for DLL registration, and `Windows\SysWOW64` subdirectories, while excluding common legitimate program and system directories.
Detects the execution of the 'gpg.exe' utility when its filename has been changed. Adversaries, particularly ransomware and loaders, often rename legitimate tools like GnuPG to evade detection while using them for encryption or decryption operations.
This rule detects the execution of the Microsoft Support Diagnostic Tool (msdt.exe) when its executable file has been renamed. Adversaries often rename legitimate system utilities to evade detection mechanisms that might be looking for the original executable name. By checking for the original filename 'msdt.exe' in the process metadata while ensuring the image path does not end with '\msdt.exe', the rule identifies instances where the utility is run under a different name.
This rule detects the execution of the 'whoami.exe' utility when its executable file name has been changed from the original 'whoami.exe'. Adversaries often rename legitimate system utilities to evade detection by security tools that monitor for specific process names. This technique is commonly used during the discovery phase to gather information about the compromised system's user context without triggering alerts associated with the standard 'whoami.exe' process name.
Detects suspicious execution of rundll32.exe without any command-line parameters, which is a known technique used by Cobalt Strike beacons for defense evasion. The rule specifically filters out common legitimate parent processes to reduce false positives.
Page 583 of 680