SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. This rule detects the creation of new custom shim database files in the default Windows shim database directories, which can indicate an attempt to abuse the Application Compatibility Infrastructure for malicious purposes.
Detects the loading of .NET Common Language Runtime (CLR) DLLs by scripting applications such as wscript, cscript, or mshta. This behavior can indicate suspicious execution, potentially involving techniques like DotNetToJScript or Donut, which use scripting hosts to execute .NET assemblies in memory. The rule specifically looks for `clr.dll`, `mscoree.dll`, or `mscorlib.dll` being loaded by a predefined list of scripting or utility executables.
Detection of unusual child processes (PowerShell or Command Prompt) spawned by critical system processes (winlogon.exe, services.exe, lsass.exe, csrss.exe, smss.exe, wininit.exe, spoolsv.exe, searchindexer.exe) running under an authorized user context. This behavior can indicate privilege escalation or defense evasion, especially if the spawned process is not related to legitimate network routing commands.
This rule detects attempts by non-privileged users (IntegrityLevel: Medium or S-1-16-8192) to modify Windows service configurations in the registry. It specifically looks for command-line executions of 'reg' with 'add' or 'powershell' with 'set-itemproperty', 'sp', or 'new-itemproperty' that target service-related registry paths (containing 'ControlSet' and 'Services') and modify critical service parameters like 'ImagePath', 'FailureCommand', or 'ServiceDLL'. This activity could indicate an attempt to establish persistence or elevate privileges by hijacking service execution.
This rule detects a specific UAC bypass method known as 'TrustedPath UAC Bypass'. This technique involves creating specially crafted directories that mimic legitimate Windows system paths (e.g., 'C:\Windows \System32\') to trick the operating system into executing an untrusted application with elevated privileges without a UAC prompt. The detection logic specifically looks for process creation events where the image path contains these malformed system directory names.
Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup. This rule detects the modification of registry keys under 'Control\Print\Monitors\' where a DLL is specified, indicating the potential for port monitor persistence.
Detects modifications to registry keys associated with Microsoft Office add-ins, which can be used for persistence. Adversaries may abuse these autostart extensibility points (ASEPs) to execute malicious code every time an Office application starts.
Detects modifications to specific registry keys under 'Software\Policies\Microsoft\Windows\System\Scripts' related to system startup, shutdown, logon, and logoff scripts. These modifications can be used to establish persistence or escalate privileges by executing malicious code at various system events.
Detects registry value settings that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.
Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. This might be used as a method of persistence. The entries found under App Paths are used primarily to map an application's executable file name to that file's fully qualified path and to prepend information to the PATH environment variable on a per-application, per-process basis.
Page 222 of 680