SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,512 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of Sysinternals PsService, a utility that can be used for service reconnaissance, management, and potential tampering. This tool can be leveraged by adversaries for discovery, privilege escalation, or persistence by interacting with Windows services.
Detects uncommon child processes spawned by "userinit.exe". Legitimate child processes of userinit.exe typically include explorer.exe, logon scripts (like netlogon.bat, UsrLogon.cmd), PowerShell.exe on Windows Core, and specific Citrix or proquota.exe processes. The rule aims to identify suspicious or malicious executables launched by userinit.exe, which could indicate persistence mechanisms or privilege escalation attempts.
Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration. This action can be used by adversaries to maintain persistence on a compromised account by preventing its password from expiring, thus avoiding the need to frequently update credentials.
This rule detects the creation or modification of a Windows service where the service binary's path is located in a suspicious directory. Adversaries often place malicious service executables in non-standard or temporary locations to evade detection and establish persistence. The rule specifically looks for service image paths containing '\Users\Public\', '\Perflogs\', '\ADMIN$\' or '\Temp\'.
Detects registry modifications that disable or change features of internal Windows tools, often used by malware for defense evasion or persistence. This includes disabling command prompt, control panel, run dialog, task manager, user account control (UAC) prompts, write protection, and notification center.
Detects the installation of a DNS plugin DLL by monitoring modifications to the 'ServerLevelPluginDll' registry parameter. This technique can be used by adversaries to execute arbitrary code within the context of the DNS server, often requiring a restart of the DNS service to take effect. This can lead to privilege escalation and persistence on a compromised system.
Detects potential COM object hijacking by monitoring modifications to the default values of InprocServer32 or LocalServer32 subkeys within specific CLSIDs in the Windows Registry. The rule specifically looks for these modifications occurring in suspicious file system locations commonly used by adversaries for persistence or staging.
Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application. This could indicate an adversary attempting to use Windows Remote Management (WinRM) for lateral movement or execution without directly invoking PowerShell, potentially to evade detection.
This rule detects potential DLL sideloading of 'EACore.dll'. It specifically looks for instances where 'EACore.dll' is loaded by an executable, but the executable or the loaded DLL is not from the legitimate 'C:\Program Files\Electronic Arts\EA Desktop\EACoreServer.exe' path. This technique can be used by adversaries for persistence, defense evasion, and privilege escalation by tricking legitimate applications into loading malicious DLLs.
Detects potential DLL sideloading of "mfdetours.dll" when loaded by a process other than the legitimate "mftrace.exe" from its expected path. This technique can be abused to force load a malicious DLL named "mfdetours.dll" from the current directory of execution, allowing for persistence, privilege escalation, or defense evasion.
Page 236 of 680