SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects msdt.exe creating files in suspicious directories, which could indicate exploitation of vulnerabilities like Follina (CVE-2022-30190) or Dogwalk. The rule specifically looks for file creations in common startup locations, public user directories, or system logs directories.
Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.
Detects potential DLL sideloading of 'AVKkid.dll' by monitoring image load events. The rule specifically looks for 'AVKkid.dll' being loaded by any process, and then filters out legitimate loads by G DATA antivirus software from its expected installation paths. This helps identify malicious instances where 'AVKkid.dll' might be used for persistence, defense evasion, or privilege escalation outside of its legitimate context.
Detects an unexpected process spawning from dns.exe, which may indicate activity related to remote code execution or other forms of exploitation, specifically referencing CVE-2020-1350 (SigRed). The rule filters out legitimate child processes like conhost.exe.
Detects the execution of the hacktool SharPersist, which is used to deploy various persistence mechanisms on Windows systems. The rule specifically identifies SharPersist.exe being executed with command-line arguments indicative of creating scheduled tasks, modifying startup folders, adding registry run keys, or installing new services for persistence.
Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.
Detects suspicious PowerShell execution initiated by a scheduled task (svchost.exe -k netsvcs -s Schedule) where the PowerShell command line includes flags commonly used to hide the PowerShell instance or bypass execution policies, such as '-windowstyle hidden', '-w hidden', '-ep bypass', or '-noni'. This pattern is indicative of persistence mechanisms, specifically referencing the PowerShell 'Get-Variable' technique used by Colibri Loader.
This rule detects the creation of a suspicious child process by 'userinit.exe'. Userinit.exe is a legitimate Windows process responsible for initializing the user environment during logon. Malicious actors may attempt to leverage or compromise this process to execute arbitrary code, establish persistence, or elevate privileges. The rule specifically filters out legitimate child processes like 'explorer.exe' and processes related to netlogon to reduce false positives.
Detects the creation or modification of a specific registry key path often used by malware families like IceID and Qakbot for persistence or defense evasion. The rule specifically looks for the registry key ending with '\Software\firm\soft\Name'. This activity has been observed in campaigns distributing malicious OneNote files.
This rule detects modifications to the 'DelegateExecute' registry value within the 'HKCU\Software\Classes\Folder\shell\open\command' key. This specific registry modification is a known technique used for COM hijacking, often leveraged in UAC bypasses, such as those involving sdclt.exe. An attacker can modify this key to execute an arbitrary program when a user attempts to open a folder, leading to persistence or privilege escalation.
Page 225 of 680