SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the creation of specific named pipes ('\imposecost' or '\imposingcost') which are known to be used by the 'Koh' tool. The 'Koh' tool is associated with credential access and privilege escalation techniques, often involving token impersonation or theft. Detection relies on Sysmon Event ID 17 or 18, which logs named pipe creation.
Detects the creation of an interactive AT job, which can be used for privilege escalation or persistence. The rule specifically looks for the execution of 'at.exe' with the 'interactive' command-line argument.
This rule detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Specifically, it looks for the creation of a process where the parent process is 'mmc.exe' and its command line contains 'WF.msc', while filtering out legitimate 'WerFault.exe' processes.
This rule detects modifications to the AppInit_DLLs registry key, which can be used by adversaries to establish persistence or elevate privileges. DLLs specified in this key are loaded by user32.dll into nearly every process that loads user32.dll. The rule specifically looks for changes to the 'AppInit_Dlls' value within the 'HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows' and 'HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows' registry paths, excluding empty values.
Detects the execution of WinSCP with the "-command" and "open" flags to establish an FTP or SFTP connection. This technique has been observed in use by the Akira ransomware group for data exfiltration.
Detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call. Adversaries may delete flow logs to evade detection or remove evidence of network activity, hindering forensic investigations and visibility into malicious operations.
This rule detects the creation of specific Windows services ('srservice', 'ipvpn', 'hkmsvc') that have been identified as malicious by ESET in their 'Carbon Paper - Turla' report. These services are associated with the Turla APT group's second-stage backdoor, indicating potential privilege escalation and persistence mechanisms.
Detects the creation of specific Windows services ('SC Scheduled Scan' or 'UpdatMachine') that have been associated with the OilRig APT group for persistence, as reported by Nyotron in their March 2018 report. This rule monitors EventID 7045 from the 'Service Control Manager' provider.
This rule detects exploitation attempts of the privilege escalation vulnerability CVE-2019-1378. The vulnerability involves the Windows 10 Update Assistant (WUA) executing `SetupComplete.cmd` or `PartnerSetupComplete.cmd` with elevated privileges. An attacker can place a malicious script in `C:\Windows\Setup\Scripts\` which will then be executed by `cmd.exe` during the update process, leading to privilege escalation. The rule specifically looks for `cmd.exe` being the parent process, executing a command line that contains `C:\Windows\Setup\Scripts\` and ends with either `SetupComplete.cmd` or `PartnerSetupComplete.cmd`, while filtering out legitimate system processes that might also execute commands from these directories.
Detects the execution pattern associated with the TAIDOOR RAT malware loading its DLL component. Specifically, it looks for command-line arguments containing 'dll,MyStart' or 'dll MyStart' in conjunction with 'rundll32.exe', which is a known method for TAIDOOR to load its malicious DLL.
Page 219 of 680