SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when the `assoc` command-line utility is used to change the default file association of any extension to an executable (`exefile`). This technique can be used by adversaries for persistence or privilege escalation by making a specific file type execute a malicious program when opened.
Detects the execution of KrbRelayUp, a hack tool used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced. The rule identifies the tool by its executable name or original filename and specific command-line arguments associated with its relay, krbscm, and spawn functionalities.
Detects the use of SettingSyncHost.exe to execute a hijacked binary. This technique leverages the legitimate Windows utility SettingSyncHost.exe, which is designed to synchronize settings across devices, to execute arbitrary commands. The rule specifically looks for instances where SettingSyncHost.exe's parent command line contains 'cmd.exe /c', 'RoamDiag.cmd', and '-outputpath', indicating an attempt to run a command-line interpreter to execute a script, while the image itself is not located in standard system directories, suggesting a hijacked execution.
This rule detects suspicious modifications to screensaver settings in the Windows Registry using `reg.exe`. Adversaries may manipulate these settings to establish persistence by executing malicious content when a user is inactive. Specifically, it looks for `reg.exe` commands that modify the `ScreenSaveActive`, `ScreenSaveTimeout`, `ScreenSaverIsSecure`, or `SCRNSAVE.EXE` registry values within `HKEY_CURRENT_USER\Control Panel\Desktop` or `HKCU\Control Panel\Desktop` with the `/f` (force) flag.
This rule detects the execution of 'vmnat.exe' when its filename has been changed. Adversaries may rename legitimate executables to evade detection, especially when attempting DLL side-loading. The rule specifically looks for processes where the original filename is 'vmnat.exe' but the executed image file path does not end with 'vmnat.exe'. This behavior could indicate an attempt to leverage a legitimate, signed executable for malicious purposes, such as DLL side-loading, where a malicious DLL is placed in the same directory as the renamed legitimate executable.
Detects potential persistence activity via Outlook Home Page by monitoring modifications to specific registry keys. An attacker can set a home page URL in Outlook's WebView registry keys to achieve code execution and persistence when a user opens a folder in Outlook.
Detects the installation of a new shim database where the file is located in a non-default location. This can be an indicator of persistence or privilege escalation attempts using application shimming.
This rule detects modifications to the 'NoLMHash' registry value, specifically when it is set to '0' (DWORD). Setting this value to '0' allows Windows to store LAN Manager (LM) hashes of user passwords in Active Directory and local Security Account Manager (SAM) databases. This action significantly weakens security as LM hashes are highly vulnerable to cracking, making credential theft easier for attackers. Attackers often enable LM hash storage to facilitate 'Pass the Hash' attacks or offline password cracking.
This rule detects modifications to the Winlogon Notify registry key to establish persistence. Adversaries may abuse Winlogon's features to execute DLLs when a user logs in. The rule specifically looks for changes to the `\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logon` registry key where the `Details` field indicates a DLL file (`.dll`) is being set.
This rule detects changes to an application's Uniform Resource Identifier (URI) configuration within Azure. Such changes can include modifications to domain names, protocol usage (e.g., switching from HTTPS), the introduction of wildcards, or URIs pointing to uncontrolled domains. These types of modifications can be indicative of an attacker attempting to redirect traffic, establish persistence, or facilitate other malicious activities by altering how an application is accessed or interacts with external resources.
Page 228 of 680