SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the creation or modification of a specific registry key associated with Windows Credential Editor (WCE). WCE is a tool used to dump credentials from memory, specifically targeting the Local Security Authority Subsystem Service (LSASS). The rule looks for the string 'Services\WCESERVICE\Start' within the 'TargetObject' field of registry events, indicating the installation or activation of WCE as a service.
Detects changes to registry values related to Outlook security settings, which could indicate an attempt to modify Outlook's behavior for persistence or other malicious purposes. This rule specifically looks for modifications within the 'SOFTWARE\Microsoft\Office\<version>\Outlook\Security\' registry path.
Detects when an attacker attempts to disable User Account Control (UAC) by modifying the 'EnableLUA' registry value to 0. This action can be part of privilege escalation or defense evasion tactics to bypass UAC prompts.
This rule detects instances where Sysmon's FileBlockShredding event (EventID 28) is triggered. This event indicates that a file shredding operation was attempted but blocked due to a configured policy violation. This could be an attempt by an adversary to destroy evidence or render data unrecoverable.
This rule detects suspicious scripting commands within WMI event consumers, which can be indicative of persistence mechanisms. Specifically, it looks for PowerShell web download commands (`new-object net.webclient .downloadstring`, `new-object net.webclient .downloadfile`), common PowerShell execution flags (`-nop`, `-noprofile`, `-decode`, `-enc`), and references to `WScript.Shell` or `System.Security.Cryptography.FromBase64Transform` within the 'Destination' field of WMI event logs. These patterns are frequently used by attackers to execute malicious scripts or download payloads via WMI persistence.
This rule detects instances where specific system binaries (msdtc.exe or gpsvc.exe) are executed from non-standard Windows system directories. This behavior is often indicative of masquerading, where malicious executables are named after legitimate system processes to evade detection, a tactic known to be used by the Lazarus Group.
Detects the creation of suspicious printer ports that point to executable files or use the 'Generic / Text Only' driver, which can be abused for persistence or execution, often associated with CVE-2020-1048 (PrintDemon).
This rule detects specific file paths, command-line arguments, and PowerShell commands associated with the Greenbug espionage group's May 2020 campaign, as reported by Symantec. It looks for suspicious executables in ProgramData directories, the use of 'revshell.exe' and 'ncat.exe' (especially with '-e cmd.exe'), and various PowerShell command patterns indicative of malicious activity, including base64 encoded strings.
Detects possible successful exploitation of CVE-2021-26858 (ProxyLogon) by monitoring for the creation of non-standard files by the Exchange Server's Unified Messaging service (UMWorkerProcess.exe). This activity could indicate the dropping of web shells or other malicious content post-exploitation.
This rule detects the creation or modification of a registry run key that exhibits characteristics associated with the 'Small Sieve' malware. Specifically, it looks for a registry path containing '\Microsoft\Windows\CurrentVersion\Run\' combined with either the intentional typo 'Microsift' in the TargetObject or the string '.exe Platypus' in the Details field. These indicators are known to be used by the Small Sieve malware for persistence.
Page 447 of 680