SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,618 copies16 likes160,618 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects DLL sideloading of system DLLs that are not present on the system by default (at least not in system directories).
Usually this technique is used to achieve UAC bypass or privilege escalation.
Usually this technique is used to achieve UAC bypass or privilege escalation.
Detects processes loading the non-existent DLL "ShellChromeAPI.dll". This behavior is often associated with DLL sideloading attacks, where an adversary places a malicious DLL with a name that a legitimate application expects to load. A known example involves "DeviceEnroller.exe" attempting to load this DLL when used with the "PhoneDeepLink" flag. Adversaries can exploit this by dropping their own renamed malicious DLL to achieve defense evasion, persistence, or privilege escalation.
Detects DLL sideloading of 'vmGuestLib.dll' by the 'WmiApSrv.exe' service. This rule specifically looks for instances where 'WmiApSrv.exe' loads 'vmGuestLib.dll' from a path that includes '\VMware\VMware Tools\vmStatsProvider\win32', while the DLL itself is not legitimately signed. This behavior can indicate an attempt to execute malicious code by tricking a legitimate process into loading a rogue DLL.
Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap utility. This rule specifically looks for VMMap (vmmap.exe or vmmap64.exe) loading a dbghelp.dll from a non-standard path ('C:\Debuggers\dbghelp.dll') where the loaded DLL is signed. This could indicate an adversary attempting to load a malicious, yet signed, DLL to evade detection or achieve persistence/privilege escalation.
Detects suspicious Windows Defender Application Control (WDAC) policy file creation from abnormal processes that could be abused by an attacker to block EDR/AV components while allowing their own malicious code to run on the system. The rule specifically looks for file creation events in the default WDAC policy directory and filters out known legitimate processes that manage these policies.
Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts.
Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies.
This behavior is often commonly observed in credential stealing malware.
Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies.
This behavior is often commonly observed in credential stealing malware.
Detects processes that query known 3rd party registry keys that holds credentials via commandline
Detects the use of reg.exe to export registry paths associated with third-party credentials.
Credential stealers have been known to use this technique to extract sensitive information from the registry.
Credential stealers have been known to use this technique to extract sensitive information from the registry.
Detects suspicious PowerShell invocation command parameters indicative of obfuscated or malicious activity, including base64 encoded commands, use of `IEX` (Invoke-Expression) with `New-Object`, encoded commands, attempts to establish persistence via Registry Run keys, and web client downloads.
This rule detects suspicious PowerShell invocations characterized by specific command parameters often used in malicious activities. It looks for combinations of parameters like '-nop', '-w hidden', '-c', and '[Convert]::FromBase64String' for base64 encoded commands; '-w hidden', '-noni', '-nop', '-c', 'iex', and 'New-Object' for obfuscated execution; '-w hidden', '-ep bypass', and '-Enc' for encoded command execution; PowerShell commands interacting with 'reg add' to modify 'Run' keys for persistence; and PowerShell using 'New-Object System.Net.WebClient' with '.Download' for downloading content from the internet, often with 'bypass' and 'hidden' window styles. These patterns are commonly associated with malware, post-exploitation frameworks, and adversary tradecraft.
Page 342 of 680