SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,479 copies16 likes159,604 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of rundll32.exe with command-line arguments indicative of loading registered COM objects. Specifically, it looks for `rundll32.exe` processes where the command line contains both `{-sta` or `-localserver` and curly braces (`{`, `}`). This pattern is often used by adversaries to achieve persistence or privilege escalation by hijacking COM objects and executing malicious code through them.
This rule detects suspicious activity involving rundll32.exe launching runonce.exe with setupapi.dll and the InstallHinfSection function. This technique can be used by adversaries to achieve persistence by modifying registry run keys or executing arbitrary code via INF files, as setupapi.dll's InstallHinfSection function can call runonce.exe regardless of the INF file's content.
This rule detects the execution of `rundll32.exe` attempting to load `shell32.dll` with the `Control_RunDLL` function, specifically when the DLL is located in suspicious user-writable directories such as `AppData`, `LocalAppData`, `Temp`, or `Users\Public`. This behavior is often indicative of defense evasion techniques used by malware to execute malicious code from non-standard locations.
Detects suspicious activity where 'rundll32.exe' is used in the command line to invoke a '.sys' file. This behavior has been observed in attacks attributed to UNC2452 (NOBELIUM).
Detects the use of the 'sc.exe' utility to change the startup type of a Windows service to 'disabled' or 'demand'. This action can be used by adversaries to impair defenses or prevent legitimate services from starting.
Detects the creation of scheduled tasks by user accounts using the 'schtasks.exe' utility. This rule specifically looks for the execution of 'schtasks.exe' with the '/create' command-line argument, while filtering out activity from common system users to reduce false positives.
This rule detects the creation of unusual child processes originating from 'SndVol.exe', which is the legitimate Windows volume mixer. The rule specifically filters out 'rundll32.exe' when it's used with 'shell32.dll,Control_RunDLL', as this is a common and legitimate behavior. Any other child processes spawned by 'SndVol.exe' are considered suspicious and could indicate an attempt to hide malicious activity behind a legitimate process.
This rule detects the creation of a child process named 'choice' by 'setres.exe', which is an uncommon and potentially malicious behavior. Setres.exe is a legitimate Windows server tool used to set screen resolution, but it can be abused to launch arbitrary executables, especially those with 'choice' in their name, from the current execution path. The rule specifically filters out legitimate instances of 'choice.exe' located in 'C:\Windows\System32\' or 'C:\Windows\SysWOW64\'.
Detects suspicious Splwow64.exe process execution without any command line parameters. This behavior can be indicative of indirect command execution or defense evasion techniques where adversaries might abuse legitimate Windows processes to execute malicious code without directly invoking a command-line interpreter.
Detects cases where an ISO file is opened within an archiving application like 7-Zip or WinRAR. This behavior is often associated with phishing campaigns where threat actors embed small ISO files in archives as email attachments to bypass security filters and protective measures (e.g., Mark-of-the-Web).
Page 584 of 680