SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus. This rule specifically looks for the loading of 'SmadHook32c.dll' or 'SmadHook64c.dll' by any process other than the legitimate SmadAV executables ('SmadavProtect32.exe' or 'SmadavProtect64.exe') from their expected installation paths.
Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") when the DLL is loaded from a non-default or unexpected directory. This technique can be used for privilege escalation, persistence, and defense evasion.
Detects suspicious outbound network connections initiated by Microsoft Sync Center (mobsync.exe) to non-private IP addresses. This activity is unusual for mobsync.exe, which typically handles offline file synchronization and should primarily communicate with internal network resources or specific cloud services, not arbitrary external IPs. Such connections could indicate compromise or malicious use of a legitimate system binary.
This rule detects the execution of the 'Reset-ComputerMachinePassword' PowerShell cmdlet. This cmdlet is used to change the computer account password that systems use to authenticate to domain controllers. Malicious use of this cmdlet can indicate an attempt to reset the local computer's password, potentially for privilege escalation, persistence, or defense evasion, as seen in some Qbot and ZeroLogon attacks.
Detects the import of '.reg' files from suspicious user-controlled or temporary paths using the 'reg.exe' utility. This activity can be indicative of an adversary attempting to modify the Windows Registry for persistence, defense evasion, or other malicious purposes by importing registry keys from a location that is easily written to.
Detects the use of regedit.exe to import a registry file (.reg) into the Windows Registry. This activity can be used by adversaries for various purposes, including establishing persistence, modifying system configurations, or defense evasion.
Detects the use of 'regini.exe' to modify registry keys by importing an alternate data stream. This technique can be used for persistence, defense evasion, or other malicious activities by adversaries.
Detects the execution of 'regsvr32.exe' attempting to load a DLL with an uncommon or unrecognized file extension. This behavior is often associated with defense evasion techniques where adversaries use legitimate Windows binaries to proxy execution of malicious code, bypassing application whitelisting or other security controls.
Detects the creation of scheduled tasks using 'schtasks.exe' that are configured to run only once and involve a temporary folder in their command line. This behavior can be indicative of an adversary establishing temporary persistence or execution mechanisms, often seen in post-exploitation activities.
Detects the creation of a scheduled task that uses PowerShell to retrieve and execute a payload stored in the Windows Registry. This technique is often used for persistence and privilege escalation by malware like Qbot.
Page 247 of 680