SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,512 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.
Detects the creation of doas.conf file in linux host platform.
This rule detects attempts to disable Event Tracing for Windows (ETW) logging specifically for .NET processes by modifying registry values. Adversaries might do this to impair defensive capabilities and hide their activities, particularly when using .NET-based malware or tools.
Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.
This rule detects the creation of suspicious executable files (.dll or .exe) by Microsoft Sync Center (mobsync.exe). While mobsync.exe is a legitimate Windows process for synchronizing offline files, its use to create executable files can be indicative of malicious activity, such as persistence, defense evasion, or privilege escalation, where an attacker might be attempting to drop and execute malicious payloads using a trusted system binary.
This rule detects the creation of 'WerFault.exe' or 'wer.dll' in directories other than the standard Windows system folders (C:\Windows\SoftwareDistribution\, C:\Windows\System32\, C:\Windows\SysWOW64\, C:\Windows\WinSxS\). This activity is highly suspicious and could indicate an attempt at DLL hijacking, specifically targeting the Windows Error Reporting process (WerFault) for privilege escalation, persistence, or defense evasion.
Detects potential DLL sideloading of "appverifUI.dll" when loaded by an 'appverif.exe' process from a non-standard or suspicious location. This rule aims to identify instances where an attacker might place a malicious 'appverifUI.dll' in a directory that 'appverif.exe' would load before its legitimate counterpart, leading to execution of the malicious DLL.
This rule detects attempts to establish persistence and elevate privileges by replacing the sticky keys executable (sethc.exe) with cmd.exe. This technique allows an attacker to gain a privileged command prompt on the Windows logon screen without authentication, typically by pressing the Shift key five times. The rule specifically looks for command-line arguments indicating the copying of cmd.exe to sethc.exe.
Detects changes to the "NoLMHash" registry value to allow Windows to store LM Hashes. Setting this registry value to "0" (DWORD) enables the storage of LAN manager hashes of passwords in Active Directory and local SAM databases, which can facilitate 'Pass the Hash' attacks.
Detects suspicious execution of rundll32.exe with command-line arguments that indicate the invocation of inline VBScript. This behavior has been observed in attacks attributed to UNC2452 (APT29/NOBELIUM), specifically using patterns like 'Execute', 'RegRead', and 'window.close' within the command line to execute malicious VBScript.
Page 229 of 680