SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,605 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects a specific pattern indicative of a User Account Control (UAC) bypass technique using DismHost DLL hijacking. This method, often associated with UACMe (specifically UACMe 63), involves a process named 'DismHost.exe' being launched from a user's temporary directory with elevated integrity levels (High or System). This behavior is suspicious because DismHost.exe is a legitimate Windows component, but its execution from a temporary user-specific path with elevated privileges suggests an attempt to bypass UAC.
Detects a specific UAC bypass technique involving the modification of the msconfig token, often associated with tools like UACMe (specifically method 55). The rule looks for a process with High or System integrity level, whose parent process is 'pkgmgr.exe' located in a temporary directory, and executes 'msconfig.exe' with the '-5' command-line argument.
This rule detects the execution of 'sdclt.exe' with elevated privileges (High integrity level). This behavior is often indicative of an attempt to bypass User Account Control (UAC) mechanisms on Windows systems. Attackers may leverage sdclt.exe, a legitimate Windows utility, to execute arbitrary commands or processes with administrative rights without triggering a UAC prompt.
This rule detects the use of "hh.exe" to download or execute remotely hosted Compiled HTML Help (.chm) files. Adversaries may abuse hh.exe, a legitimate Windows utility, to bypass application control or execute malicious code by loading CHM files from remote HTTP/HTTPS or UNC paths. This technique can be used for defense evasion and initial access.
Detection rule generated by AI system
Detects a specific User Account Control (UAC) bypass technique known as "IDiagnosticProfileUAC". This technique involves a process with high or system integrity level launching 'DllHost.exe' with a specific command-line argument containing '{12C21EA7-2EB8-4B55-9249-AC243DA8C666}'. This behavior is indicative of an attempt to elevate privileges by bypassing UAC.
This rule detects a User Account Control (UAC) bypass technique that exploits a path parsing vulnerability in `winsat.exe`. Specifically, it looks for the creation of a process with 'High' or 'System' integrity levels where the parent process image path ends with `\AppData\Local\Temp\system32\winsat.exe` and the parent command line contains `C:\Windows \system32\winsat.exe`. This pattern is indicative of UACMe method 52, which leverages a specially crafted path to trick `winsat.exe` into executing an arbitrary payload with elevated privileges.
Detects the execution of SharpMove, a .NET utility used for lateral movement that performs tasks such as task creation, Service Control Manager (SCM) queries, and VBScript execution via WMI. The detection is based on the executable name or original filename and the presence of specific command-line arguments indicating its functionality.
Detects the modification of the system's code page to Russian language (code page 1251 or 866) using the `mode.com` utility. This activity has been observed in attacks involving Dharma ransomware and other malware.
Detects modifications to the "Default" value of specific 'MyComputer' registry keys and their subkeys. This technique can be used by adversaries to establish persistence by pointing to a custom binary that will be launched when an associated action (e.g., opening 'My Computer') is executed. This method leverages less common registry locations for persistence compared to standard Run keys.
Page 374 of 680