SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,618 copies16 likes160,616 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects potential DLL sideloading of "chrome_frame_helper.dll". It triggers when "chrome_frame_helper.dll" is loaded from a location other than the legitimate Google Chrome application directories (C:\Program Files\Google\Chrome\Application\ or C:\Program Files (x86)\Google\Chrome\Application\) or the user's local AppData path for Chrome.
Detects potential DLL sideloading using comctl32.dll by monitoring specific Windows executables loading this DLL from a '.local' directory, which is a common technique for privilege escalation and defense evasion.
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
This rule detects potential DLL sideloading attempts involving specific third-party software DLLs. It identifies when 'commfunc.dll' (associated with Lenovo software) or 'tosbtkbd.dll' (associated with Toshiba Bluetooth software) are loaded from unexpected or non-standard paths. The rule aims to catch instances where an attacker might place a malicious DLL with the same name in a location that a legitimate application will load before its intended, legitimate DLL, thereby achieving execution, persistence, privilege escalation, or defense evasion.
This rule detects potential DLL sideloading attempts targeting DLLs associated with the Wazuh security platform. Specifically, it looks for `libwazuhshared.dll` or `libwinpthread-1.dll` being loaded from locations outside of standard program file directories (e.g., `C:\Program Files\` or `C:\Program Files (x86)\`). It also filters out common legitimate loads of `libwinpthread-1.dll` from `AppData` or `ProgramData` within `mingw64` paths.
This rule detects potential DLL sideloading of an unsigned 'dbghelp.dll' by the Sysinternals tool VMMap. Adversaries may place a malicious, unsigned 'dbghelp.dll' in a location where VMMap (vmmap.exe or vmmap64.exe) will load it instead of the legitimate, signed version. This technique can be used for defense evasion, persistence, or privilege escalation by executing arbitrary code within the context of a trusted application.
Detects file creation events with filename patterns used by Impacket.
This rule detects potential DLL sideloading of 'libvlc.dll'. Adversaries may place a malicious 'libvlc.dll' in a directory that is searched before the legitimate VLC installation path, causing a legitimate application to load the malicious DLL instead of the intended one. This technique can be used for defense evasion, persistence, and privilege escalation. The rule specifically looks for 'libvlc.dll' being loaded from any location other than the default VLC installation directories.
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.
This rule detects potential DLL sideloading activity involving the 'JSESPR.dll' library when it is loaded from a location other than the legitimate 'C:\Program Files\Common Files\Justsystem\JsSchHlp\' directory. This specific behavior is associated with the JUSTSYSTEMS Japanese word processor and has been observed in campaigns like 'Operation LiberalFace' targeting Japanese political entities.
Page 341 of 680