SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects a suspicious `explorer.exe` subprocess spawned by `RazerInstaller.exe` with elevated privileges (System integrity level). While `explorer.exe` can be legitimately invoked by the installer to select a different installation folder, this specific behavior with System integrity can indicate an attempt to exploit a vulnerability in the RazerInstaller software for privilege escalation to LOCAL SYSTEM.
Detects potential suspicious child processes spawned by '3CXDesktopApp.exe', which could indicate compromise related to the 3CXDesktopApp supply chain attack. Specifically, it looks for the 3CXDesktopApp spawning common system binaries often abused for execution, command and control, or defense evasion.
Detects the creation or modification of a custom protocol handler in the Windows Registry with the name "rogue" and a specific CLSID. This activity has been observed as a persistence mechanism used by the Forest Blizzard APT group (also known as Star Blizzard or COLDRIVER). By setting a custom protocol handler, the adversary can execute arbitrary code when a specially crafted URI is accessed.
Detects remote registry management attempts using the 'reg' utility originating from a workstation not designated as an administrator workstation. This could indicate an attacker attempting to query or modify the registry of a remote system from an unauthorized host.
Detects calls to the "New-NetFirewallRule" cmdlet from PowerShell in order to add a new firewall rule with an "Allow" action. This activity can be indicative of an adversary attempting to bypass network controls for C2, lateral movement, or data exfiltration.
This rule identifies modifications to the `/etc/ld.so.preload` file. This file is used by the Linux dynamic linker to specify shared libraries that should be loaded before any other libraries. Attackers can modify this file to inject malicious shared objects into processes, enabling privilege escalation, persistence, or defense evasion by loading arbitrary code.
Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators
This rule detects the addition of a Security Identifier (SID) to an Active Directory object's SID History attribute. Attackers can manipulate the SID History to gain unauthorized privileges, often by adding SIDs of highly privileged accounts (like Domain Admins) to a compromised user or computer object. This allows the compromised account to impersonate the privileged account and bypass access controls. The rule specifically looks for Event IDs 4765 (SID History added to an account) or 4766 (SID History added to a group) or Event ID 4738 (User Account Changed) where the 'SidHistory' field is not null or '%%1793' (which indicates no SID History).
Detects the creation of new Windows services that exhibit characteristics commonly associated with Cobalt Strike beacon activity, specifically focusing on suspicious ImagePath values. This includes services created with paths pointing to ADMIN$ shares, PowerShell commands for execution, or encoded PowerShell commands often used for downloading and executing payloads.
Detects the installation of a new service by Meterpreter or Cobalt Strike's 'getsystem' command. This rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, combined with command-line patterns indicative of Meterpreter/Cobalt Strike's techniques for privilege escalation, such as using 'echo' to a named pipe, 'rundll32' with specific arguments, or creating a service from a local administrative share.
Page 215 of 680