SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,593 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects a Windows service binary being created or executed from suspicious directories that are commonly used by adversaries for defense evasion or persistence. The rule specifically looks for processes whose parent is 'services.exe' or 'svchost.exe' and whose image path contains known suspicious user-writable or system-specific directories.
Detects the execution of 'control.exe' as a child process of 'WorkFolders.exe', specifically when 'control.exe' is not launched from its default system directory. This behavior can indicate an attempt to bypass security defenses by proxying execution through a trusted Windows binary.
Detects the execution of the `wmic.exe` utility with the `computersystem` flag to gather information about the machine, such as domain, username, and model. This activity is often performed by adversaries during the discovery phase to understand the environment.
Detects the usage of wmic.exe to start or stop a Windows service. This activity can be indicative of an adversary attempting to manipulate system services for various malicious purposes, such as persistence, privilege escalation, or defense evasion. While wmic.exe is a legitimate system tool, its use to control services should be monitored, especially when originating from unusual processes or user contexts.
Detects suspicious activity involving the Windows Update Agent (wuauclt.exe) where the process is executed without any command-line arguments. This behavior can be indicative of an adversary attempting to masquerade malicious activity by abusing a legitimate system utility.
Detects the execution of a Sysinternals Tool via the creation of the "EulaAccepted" registry key. Many Sysinternals tools create this key upon first execution to signify acceptance of the End User License Agreement (EULA). This can be an indicator of Sysinternals tools being used on a system, which are often leveraged by adversaries for various post-exploitation activities.
Detects the creation of the "accepteula" registry key by Sysinternals tools that have been renamed. This behavior is suspicious because legitimate Sysinternals tools typically create this key with their original executable names. Adversaries often rename tools to evade detection, and this rule specifically looks for instances where the EULA acceptance key is created by an executable whose name does not match the expected Sysinternals tool name.
This rule detects the creation of a local hidden user account by monitoring Windows Registry events. Specifically, it looks for modifications within the 'SAM\SAM\Domains\Account\Users\Names\' registry path where the target object (the account name) ends with a '$' character, indicating a hidden account. The detection is further refined by ensuring the event is generated by 'lsass.exe', which is responsible for managing user accounts and authentication.
Detects the creation or modification of a specific registry key path associated with the 'Pandemic' Windows implant. The key path observed is '\SYSTEM\CurrentControlSet\services\null\Instance'. This rule helps identify the presence or activity of the Pandemic malware.
This rule detects modifications to the Windows Registry key associated with "TrustRecords" for Microsoft Office applications. These trust records are created when a user enables macros in a document, indicating that the document's source is trusted. Adversaries often leverage malicious macros in documents as an initial access vector. Monitoring changes to this registry path can help identify when macros are being enabled, potentially by a user interacting with a malicious document.
Page 594 of 680