SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,512 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects a suspicious crash of the Microsoft Malware Protection Engine (MsMpEng.exe), specifically when the mpengine.dll module is involved. Such crashes can indicate an attempt to exploit vulnerabilities in the antivirus software to bypass security defenses or disable the tool. The detection relies on Windows Error Reporting (EventID 1001) logs containing specific process and module names.
Detects potential installation or installation attempts of known malicious AppX packages by monitoring Windows AppXDeployment-Server Event IDs 400 and 401, specifically looking for a known malicious package full name.
Detects the creation of a new Background Intelligent Transfer Service (BITS) job by the `bitsadmin.exe` utility. Adversaries may use BITS jobs for various purposes, including downloading malicious files, maintaining persistence, or exfiltrating data, as BITS jobs can operate in the background and persist across reboots.
Detects the loading of an unsigned kernel module on a Windows system, which can indicate attempts to bypass security controls, establish persistence, or escalate privileges. This event is logged by Windows Code Integrity when it determines that a kernel module without a valid digital signature is being loaded.
This rule detects the installation of an Exchange Transport Agent. Transport agents are .NET assemblies that can operate on email messages passing through the Exchange transport pipeline. Adversaries may abuse this functionality to establish persistence, intercept emails, or exfiltrate data.
Detects the creation or removal of a computer account in Active Directory. This can be indicative of attacks such as DCShadow, which involves registering a rogue Domain Controller to manipulate Active Directory data. The rule specifically looks for Windows Security Event IDs 4741 (A computer account was created) and 4743 (A computer account was deleted).
Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed. It is recommended to turn off "Local Group Policy Object Processing" via GPO to ensure Active Directory GPOs take precedence over local/edited computer policies.
Detects the creation or renaming of a user account with a '$' character in its name. This technique can be used by adversaries to hide user accounts or evade detection systems that may not properly parse or display such characters, making the account appear less conspicuous or legitimate.
This rule detects the installation of packet capture (pcap) drivers on Windows systems by monitoring Event ID 4697 (A service was installed in the system). The detection logic specifically looks for common filenames associated with pcap drivers such as 'pcap', 'npcap', 'npf', 'nm3', 'ndiscap', 'nmnt', 'windivert', 'USBPcap', and 'pktmon' within the ServiceFileName field. The installation of such drivers can indicate an adversary's attempt to perform network sniffing.
Detects the installation of the 'RTCore64' service, which is associated with Micro-Star MSI Afterburner. This service can be abused by attackers to load vulnerable drivers, a technique often referred to as 'Bring Your Own Vulnerable Driver' (BYOVD) for privilege escalation or defense evasion.
Page 451 of 680