SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of a macro file for Outlook, specifically 'VbaProject.OTM', which can be used for persistence or to execute malicious code. The rule filters out legitimate creations by 'outlook.exe' to reduce false positives.
This rule detects attempts to leverage the COR_PROFILER environment variable for process scope hijacking. Adversaries may use COR_PROFILER to load a malicious DLL into .NET processes, enabling persistence, privilege escalation, or defense evasion. The detection specifically looks for PowerShell script block text that sets the COR_ENABLE_PROFILING, COR_PROFILER, and COR_PROFILER_PATH environment variables, which are indicative of this technique.
This rule detects PowerShell script block logging events that indicate an attempt to establish persistence using Windows Management Instrumentation (WMI) event subscriptions. Specifically, it looks for the creation of WMI event filters (`__EventFilter`) and command-line event consumers (`CommandLineEventConsumer`) within the `root/subscription` namespace, which are common components of WMI persistence techniques.
This rule detects the use of the Deployment Image Servicing and Management (DISM) tool to enable the 'WindowsPowerShellWebAccess' feature. Adversaries may enable this feature to establish remote access to a system, potentially for persistence, privilege escalation, or further malicious activities. The detection specifically looks for `dism.exe` or `DISM.EXE` being executed with command-line arguments that include 'WindowsPowerShellWebAccess', '/online', and '/enable-feature'.
This rule detects attempts to modify the ImagePath value of a Windows service using the 'reg.exe' utility. Adversaries may hijack existing service registry entries to execute their own malicious payloads, leveraging flaws in permissions to redirect the service's executable to one they control. This allows them to achieve persistence and potentially privilege escalation when the service starts.
Detects the creation of new scheduled tasks via commandline using `schtasks.exe` that specifically call `OpenSSH` components (`sshd.exe` or `ssh.exe`) with parameters indicative of establishing a reverse SSH tunnel. This activity suggests an adversary is attempting to establish persistence and command-and-control by creating a scheduled task to maintain a connection to their server.
This rule detects the creation or modification of the 'AppCertDlls' registry key. Adversaries can abuse this registry key to achieve persistence and privilege escalation by causing a malicious DLL to be loaded and executed in the context of other processes. The rule specifically looks for changes to the 'HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls' key or its potential rename.
Detects GitHub activity associated with the 'Shai-Hulud' NPM supply chain attack. The attack involves malicious NPM packages that use stolen GitHub tokens to create a new branch, inject a malicious workflow file to exfiltrate secrets, and make private repositories public.
Detects activity mentioned in the Operation Wocao report, specifically the use of 'checkadmin.exe' to enumerate local administrators. This tool is used by the threat actor to identify potential targets for privilege escalation or lateral movement.
This rule detects attempts to modify system services or WMI settings, which are behaviors associated with the Blue Mockingbird cryptominer. Specifically, it looks for 'sc config' commands that include 'wercplsupporte.dll' and 'wmic.exe' commands ending with 'COR_PROFILER'. These command-line patterns indicate potential persistence or defense evasion mechanisms used by the threat.
Page 216 of 680