SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,512 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of a scheduled task using `schtasks.exe` that includes `curl` for downloading content and `powershell` for execution within the task's action. This combination is often used by adversaries to establish persistence, download malicious payloads, and execute them without directly dropping malware on the host, facilitating command and control.
Detects the creation of scheduled tasks using 'schtasks.exe' where the task's executable path points to suspicious folders or uses environment variables commonly abused by malware for persistence or privilege escalation. This rule specifically looks for tasks created in locations like 'Perflogs', 'Users\All Users', 'Users\Default', 'Users\Public', 'Windows\Temp', 'AppData\Local', 'AppData\Roaming', or using '%AppData%' and '%Public%' environment variables.
Detects the creation or modification of a scheduled task using 'schtasks.exe' that is configured to run with 'NT AUTHORITY\SYSTEM' privileges. This can be an indicator of privilege escalation or persistence.
This rule detects attempts to add users to highly privileged groups on Windows systems. It specifically looks for command-line executions of 'net localgroup <groupname> /add' or 'Add-LocalGroupMember -Group <groupname>' where the group name is either 'Group Policy Creator Owners' or 'Schema Admins'. These groups are considered highly privileged, and unauthorized additions could indicate privilege escalation or persistence.
Detects instances where the Windows Installer service (msiexec.exe) spawns command-line interpreters like cmd.exe or PowerShell.exe. This behavior is often associated with the 'AlwaysInstallElevated' policy being enabled, which can lead to privilege escalation.
Detects modifications to specific registry keys related to NetNTLM authentication settings. These modifications can indicate an attempt to downgrade NetNTLM security, potentially enabling NetNTLM downgrade attacks. The rule specifically looks for changes to 'lmcompatibilitylevel', 'NtlmMinClientSec', and 'RestrictSendingNTLMTraffic' within the LSA registry path to less secure values.
Detects modifications to specific autostart extensibility points (ASEPs) within the Windows Registry's Session Manager key. These modifications can be used by adversaries to establish persistence or elevate privileges by ensuring malicious code is executed during system boot or user logon. The rule specifically targets changes to 'SetupExecute', 'S0InitialCommand', 'KnownDlls', 'Execute', 'BootExecute', and 'AppCertDlls' values under the 'System\CurrentControlSet\Control\Session Manager' path.
Detects the creation or modification of Windows services in the registry that exhibit patterns commonly associated with Cobalt Strike beacons for persistence, privilege escalation, or lateral movement. Specifically, it looks for registry modifications to service control sets containing 'ADMIN$' and '.exe' or '%COMSPEC%', 'start', and 'powershell' in the service details, indicating a potential malicious service installation.
Detects the disabling of crash dumps by modifying the 'CrashControl' registry key to set the 'CrashDumpEnabled' value to 0. This activity has been observed in malware like HermeticWiper to hinder forensic analysis.
This rule detects modifications to the Windows Registry keys associated with Application Shimming. Adversaries may use application shims to establish persistence and/or elevate privileges by executing malicious content. The rule specifically looks for changes within the 'InstalledSDB' and 'Custom' AppCompatFlags registry paths, which are used to store information about installed shim databases.
Page 230 of 680