SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects attempts to exploit a DLL search order hijacking vulnerability in the Windows Fax service. Specifically, it looks for instances where the 'fxssvc.exe' process attempts to load 'ualapi.dll' from a location other than the legitimate Windows system directories (e.g., 'C:\Windows\WinSxS\'). This indicates that an attacker may have placed a malicious 'ualapi.dll' in a directory that the Fax service searches before the legitimate system path, leading to the execution of the attacker's code.
Detects the loading of 'glib-2.0.dll' by the 'VMwareXferlogs.exe' utility from a directory other than the default VMware installation path. This behavior is indicative of potential DLL sideloading, where an attacker might place a malicious DLL in a non-standard location to be loaded by a legitimate application, often for privilege escalation, persistence, or defense evasion.
Detects the loading and execution of an unsigned Thor scanner binary. This rule specifically looks for 'thor.exe' or 'thor64.exe' being loaded, and then filters out instances where the binary is legitimately signed by 'Nextron Systems GmbH' with a valid signature status. This helps identify potentially malicious or unauthorized versions of the Thor scanner.
Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
This rule detects process injection activities originating from Microsoft Word (winword.exe) that are characteristic of a LittleCorporal generated malicious document. Specifically, it looks for winword.exe as the source image performing process access, combined with a call trace that includes a .NET Framework 64-bit v2.x path and an 'UNKNOWN' module, which is indicative of injected code.
This rule detects the use of `bitsadmin.exe` to create or modify BITS jobs that can be used for persistence. Specifically, it looks for command-line arguments that either set a notification command (`/SetNotifyCmdLine`) to execute a program (like `cmd.exe` or `regsvr32.exe`) or add a file for download (`/Addfile`) from a remote HTTP/HTTPS/FTP source. Adversaries can abuse BITS jobs to schedule the download and execution of malicious binaries, establishing a backdoor and maintaining persistence on a system.
Detects the execution of Chromium-based browsers (Brave, Chrome, MS Edge, Opera, Vivaldi) in headless mode using the "dump-dom" command-line argument. This technique can be used to download files or extract content from web pages without a visible browser interface, often for malicious purposes like data exfiltration or staging.
This rule detects the use of the 'reg.exe' command-line tool to add entries to specific Windows Registry Run keys. These Run keys are commonly used by adversaries to establish persistence, ensuring that a malicious program executes automatically when a user logs in. The rule specifically looks for 'reg.exe' being executed with 'add' command and targeting 'Software\Microsoft\Windows\CurrentVersion\Run', 'Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run', or 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run' registry paths.
Detects the modification of the Local Security Authority (LSA) configuration to register a malicious password filter DLL. This is achieved by looking for command-line arguments that attempt to add or modify registry keys under 'HKLM\SYSTEM\CurrentControlSet\Control\Lsa' related to password filters, specifically involving 'scecli' and 'reg add'. This technique is often used by adversaries to harvest credentials.
Detects changes to the "DisableRestrictedAdmin" registry value via process creation events. This registry value controls RestrictedAdmin mode, which prevents the transmission of reusable credentials to a remote system during Remote Desktop connections, thereby mitigating credential harvesting if the remote server is compromised. This rule specifically looks for command-line arguments that indicate an attempt to modify this registry key.
Page 237 of 680