SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,598 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the loading of the Windows Restart Manager (RstrtMgr.dll) by a process executing from a suspicious directory. This DLL has been observed in ransomware campaigns (e.g., Conti, Cactus) and wipers (e.g., BiBi) to terminate processes that might lock files, facilitating encryption or data destruction. It could also be used for anti-analysis purposes.
Detects suspicious process access requests to the LSASS process using specific GrantedAccess flags. These flags are often associated with tools and techniques used for credential dumping, such as Mimikatz, by attempting to read or manipulate LSASS memory to extract credentials. The rule includes filters for common legitimate processes like antivirus software, EDRs, and system utilities to reduce false positives.
Detects the execution of the 'msxsl.exe' utility with an 'http' keyword in the command line, indicating a potential attempt to execute XSL files from a remote source. This technique can be used by adversaries to bypass application control and execute malicious scripts.
Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects the modification of the 'Ime File' registry value within the 'Keyboard Layouts' key to include an uncommon file extension. This technique can be used by attackers to load a malicious DLL into a process via the Windows Input Method Editor (IME) feature, typically after sending a WM_INPUTLANGCHANGEREQUEST message. The rule specifically looks for modifications where the 'Ime File' value does not end with the standard '.ime' extension, indicating potential malicious activity.
Detects the use of 'IMEWDBLD.exe', a legitimate Microsoft binary, to download arbitrary files from HTTP or HTTPS sources. This technique is often abused by adversaries for ingress tool transfer or to fetch additional malicious payloads, leveraging a trusted binary to bypass defenses.
This rule detects the creation of a remote thread by a PowerShell process (powershell.exe or pwsh.exe) into specific target processes, namely rundll32.exe or regsvr32.exe. This activity is often indicative of defense evasion and execution techniques used by adversaries to inject malicious code or achieve persistence by leveraging legitimate system binaries.
This rule detects the execution of `find.exe` or `findstr.exe` on Windows systems when used to search for keywords commonly associated with security tools. Attackers often use these utilities to discover installed security software by piping the output of other reconnaissance commands (like `tasklist` or `whoami`) through `findstr` to filter for specific terms. The rule specifically looks for command-line arguments containing keywords such as "avira", "cb", "cylance", "defender", "kaspersky", "kes", "mc", "sec", "sentinel", "symantec", and "virus", including variations with double quotes.
Detects the usage of 'Squirrel.exe' or 'Update.exe' to download arbitrary files. These binaries are often part of Electron-based software installations (e.g., Slack, Teams, Discord) and can be abused for proxy execution and file download, leveraging their trusted status.
Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE. The downloaded files are temporarily stored in ":\Users\%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\<RANDOM-8-CHAR-DIRECTORY>". This technique can be used for defense evasion and execution.
Page 388 of 680