SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,474 copies16 likes159,599 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Bypass UAC via CMSTP
Sigma
Detects command-line usage of Microsoft Connection Manager Profile Installer (cmstp.exe) with specific flags often used to install specially formatted local .INF files for privilege escalation or defense evasion. This technique is commonly associated with UAC bypasses.
Detects a User Account Control (UAC) bypass technique that leverages the Event Viewer's RecentViews functionality. This method involves manipulating the RecentViews file to execute arbitrary code with elevated privileges without triggering a UAC prompt. The rule specifically looks for command-line arguments that reference 'Event Viewer\RecentViews' or 'EventV~1\RecentViews' in conjunction with a redirection operator ('>'), indicating an attempt to write to or modify this file.
Detects the use of WSReset.exe to bypass User Account Control (UAC). This technique allows adversaries to execute privileged processes without a UAC prompt.
This rule detects attempts to list credentials stored in the Windows Credential Manager using the native Windows utility `vaultcmd.exe`. Specifically, it looks for process creation events where `VaultCmd.exe` is executed with the `/listcreds:` command-line argument, indicating an attempt to enumerate stored credentials.
Detects execution of "VSDiagnostics.exe" with the "start" or "launch" command-line arguments to proxy the execution of arbitrary binaries. This technique can be used by adversaries to bypass defenses by leveraging a legitimate, signed Microsoft binary.
Detects Microsoft Visual Studio vsls-agent.exe execution with a suspicious library load using the --agentExtensionPath parameter. This technique can be used to proxy execution of malicious code by abusing a legitimate signed binary.
This rule detects unusual parent or child processes associated with `wab.exe` (Windows Contacts) and `wabmig.exe` (Microsoft Address Book Import Tool). These processes are typically not involved in spawning other processes or being spawned by unusual parents. The rule specifically looks for `wab.exe` or `wabmig.exe` being spawned by `WmiPrvSE.exe`, `svchost.exe`, or `dllhost.exe`, or if `wab.exe` or `wabmig.exe` themselves spawn any child processes. This behavior has been observed in connection with Bumblebee loader activity, indicating potential malicious execution or defense evasion.
Detects the execution of 'wab.exe' (Windows Contacts) and 'wabmig.exe' (Microsoft Address Book Import Tool) when they are launched from non-default, suspicious locations. This behavior has been observed in campaigns involving the Bumblebee loader, where these legitimate Windows executables are abused for malicious purposes, often as part of defense evasion or execution tactics.
Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands. This activity is often associated with webshells attempting to understand the capabilities of the compromised server.
Detects suspicious file downloads directly from IP addresses using Wget.exe. This rule looks for executions of wget.exe where the command line contains an IP address, 'http', an output flag like '-O' or '--output-document', and a suspicious file extension. This behavior is often associated with adversaries transferring tools or malware onto a compromised system.
Page 586 of 680