SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects attempts to modify the ImagePath value of a Windows service using the 'reg.exe' utility. Adversaries may hijack existing service registry entries to execute their own malicious payloads, leveraging flaws in permissions to redirect the service's executable to one they control. This allows them to achieve persistence and potentially privilege escalation when the service starts.
Detects scheduled task creation using the 'schtasks' utility that incorporates suspicious or uncommon command-line patterns. This includes tasks scheduled to run frequently (e.g., every minute) or as the 'system' user, combined with common command interpreters ('cmd'), or containing keywords often associated with malicious activity like PowerShell download commands, obfuscation techniques, or execution from temporary/public user directories. It also flags the use of scripting engines (cscript, wscript) or curl within scheduled tasks.
Detects the deletion of registry entries within the `.*\shell\open\command` keys. This activity is often associated with COM hijacking, where an attacker modifies these keys to execute their malicious code instead of legitimate applications. The deletion of these keys could indicate an adversary attempting to remove traces of their COM hijacking activities.
Detects changes to the Netsh registry key to add a new DLL value that is located in a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper.
Detects an attacker trying to enable the Outlook security setting "EnableUnsafeClientMailRules" which allows Outlook to run applications or execute macros. This can be used for persistence or defense evasion.
Detects suspicious encoded payloads within WMI Event Consumers. This rule specifically looks for base64 encoded strings containing keywords commonly associated with process injection or executable characteristics, such as 'WriteProcessMemory', 'This program cannot be run in DOS mode', and 'This program must be run under Win32'. The presence of these strings in a WMI event consumer's destination property suggests an attempt to establish persistence or execute malicious code via WMI.
Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
Detects the execution of DLL side-loading malware used by the threat group Emissary Panda, also known as APT27. Specifically, it looks for `svchost.exe` being spawned by `sllauncher.exe` or `svchost.exe` being spawned from a user's `AppData\Roaming` directory with the `-k` command-line argument, which are indicators of this specific malware's behavior.
This rule detects the creation or modification of specific registry keys that have been observed in attacks attributed to the OceanLotus (also known as APT32) threat group. The rule specifically looks for patterns in `TargetObject` paths related to CLSID entries and `AppX` entries within `HKCU\SOFTWARE\Classes` and `HKCU\SOFTWARE\App`.
Detects registry modifications associated with the exploitation of Windows vulnerabilities CVE-2021-31979 and CVE-2021-33771, which were reportedly used by the threat group Sourgum with the DevilsTongue malware. Specifically, it looks for changes to the default values of InprocServer32 for specific CLSIDs, while filtering out legitimate system DLLs.
Page 214 of 680