SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,618 copies16 likes160,617 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location. This technique can be used by adversaries to execute malicious code by tricking a legitimate application into loading a malicious DLL instead of its legitimate counterpart.
Detects the creation of a malicious DLL file named 'iphlpapi.dll' within the 'AppData\Local\Microsoft' directory, which is commonly used by applications like Microsoft Teams or OneDrive. This technique is often employed for DLL sideloading, where a legitimate application loads a malicious DLL placed in a specific directory, leading to code execution, persistence, privilege escalation, or defense evasion.
Detects the loading of Microsoft Office DLLs, specifically 'outllib.dll', from non-standard file system locations. This behavior is indicative of DLL sideloading, a technique used by adversaries for defense evasion, persistence, and privilege escalation.
Detects the creation of system DLLs that are usually not present on the system (or at least not in system directories). This technique is commonly used to achieve DLL hijacking, which can lead to defense evasion, persistence, and privilege escalation.
This rule detects attempts to bypass User Account Control (UAC) by loading a fake 'dismcore.dll' with 'dism.exe'. This technique involves placing a malicious 'dismcore.dll' in a location where 'dism.exe' will load it instead of the legitimate system DLL, often leading to privilege escalation.
This rule detects potential DLL sideloading of 'CCleanerReactivator.dll'. It specifically looks for instances where 'CCleanerReactivator.dll' is loaded by an image that is NOT the legitimate 'CCleanerReactivator.exe' located in the standard CCleaner installation paths ('C:\Program Files\CCleaner\' or 'C:\Program Files (x86)\CCleaner\'). This behavior can indicate an adversary attempting to execute malicious code by tricking a legitimate application into loading a malicious DLL.
Detects when an attacker creates a similar folder structure to Windows system folders (such as Windows, Program Files) but with an additional space in the directory name. This technique aims to trick the DLL load search order, leading to a "DLL Search Order Hijacking" attack where a malicious DLL can be loaded instead of a legitimate one.
Detects potential DLL sideloading of "7za.dll". This technique involves an attacker placing a malicious DLL (named 7za.dll in this case) in a location where a legitimate application expects to load a benign version of the DLL. By doing so, the malicious DLL is loaded and executed by the legitimate application, allowing the attacker to achieve defense evasion, persistence, or privilege escalation. The rule specifically looks for instances where '7za.dll' is loaded by an executable not residing in standard 'Program Files' directories, which are typically trusted locations.
Detects potential DLL sideloading of "CCleanerDU.dll" when loaded by an executable that is not the legitimate CCleaner application (CCleaner.exe or CCleaner64.exe) or is not located in the standard CCleaner installation paths.
Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software
Page 340 of 680