SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects potential DLL sideloading of 'rcdll.dll' by monitoring image load events. The rule specifically looks for 'rcdll.dll' being loaded from locations other than standard Microsoft Visual Studio or Windows Kits directories, which are considered legitimate paths for this DLL. This activity can indicate an adversary attempting to execute malicious code by tricking a legitimate application into loading a rogue DLL.
Detects the loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary from the "C:\$SysReset\Framework\Stack\" directory. This behavior is suspicious because the "$SysReset" directory is not created by default, suggesting an adversary might be abusing this path for DLL sideloading to achieve persistence, privilege escalation, or defense evasion.
Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" when "SystemResetPlatform.exe" is executed from a non-default, suspicious location. This technique can be used for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of "vivaldi_elf.dll" when it is loaded by an executable other than the legitimate Vivaldi browser application. This technique can be used for persistence, defense evasion, and privilege escalation by tricking a legitimate application into loading a malicious DLL.
This rule detects the execution of 'csi.exe' or 'rcsi.exe', which are signed Microsoft binaries associated with Visual Studio. These executables provide C# interactive capabilities and can be abused by adversaries to run arbitrary C# code from a file, potentially bypassing application whitelisting and enabling execution or defense evasion. The rule specifically looks for the process image ending with '\csi.exe' or '\rcsi.exe' or the original filename being 'csi.exe' or 'rcsi.exe', combined with the company name 'Microsoft Corporation'.
Detects the use of the PhoneDeepLink parameter with DeviceEnroller.exe to potentially sideload a non-existent DLL file named "ShellChromeAPI.dll". Adversaries can leverage this technique by dropping their own renamed malicious DLL and executing it via DeviceEnroller.exe using this parameter.
Detects an anomalous execution of 'dllhost.exe' where the process spawns without any command-line arguments. This behavior is highly unusual for legitimate 'dllhost.exe' processes and can indicate malicious activity such as process injection or malware attempting to masquerade as a legitimate system process.
Detects attempts to disable security event logging by adding the `MiniNt` registry key. This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications. Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.
Detects the execution of the DInjector PowerShell cradle, identified by specific command-line arguments '/am51' and '/password'. This tool is often used for process injection and privilege escalation.
This rule detects the creation of suspicious child processes by 'KeyScrambler.exe'. KeyScrambler is legitimate software designed to encrypt keystrokes, but if compromised, it could be used to launch malicious binaries. The rule specifically looks for 'KeyScrambler.exe' as a parent process launching common Windows utilities often abused by attackers, such as 'cmd.exe', 'cscript.exe', 'mshta.exe', 'powershell.exe', 'pwsh.exe', 'regsvr32.exe', 'rundll32.exe', and 'wscript.exe'. This behavior could indicate an attacker leveraging a compromised KeyScrambler process for execution, defense evasion, or privilege escalation.
Page 242 of 680