SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (Kernel Driver Utility) or Ghost-In-The-Logs, which uses KDU. This activity can indicate an attempt to load a malicious driver for defense evasion or other purposes.
This rule detects the creation or modification of a PowerShell profile specifically for Visual Studio Code (VSCode). Adversaries may modify these profiles to establish persistence or escalate privileges by injecting malicious commands or scripts that execute every time a user opens a VSCode PowerShell session. This technique can be used to run arbitrary code without direct user interaction after the initial compromise.
This rule detects a specific pattern indicative of a User Account Control (UAC) bypass technique using 'IEInstal.exe'. Specifically, it looks for 'IEInstal.exe' creating a file named 'consent.exe' within a user's temporary application data directory (e.g., 'C:\Users\<username>\AppData\Local\Temp\'). This behavior is characteristic of UACMe, an open-source tool designed to exploit various UAC bypass methods.
Detects a specific User Account Control (UAC) bypass technique that involves modifying the msconfig GUI. This rule specifically looks for the creation of a file named 'pkgmgr.exe' within a user's temporary directory, which is a known indicator for the UACMe bypass method 55.
Detects cmstp loading "dll" or "ocx" files from suspicious locations, which is a known technique for defense evasion and proxy execution. Adversaries can abuse CMSTP.exe, a legitimate Microsoft binary, to load and execute malicious DLLs or OCX files from non-standard directories, potentially bypassing application whitelisting and other security controls.
Detects when a .NET assembly DLL from the Windows assembly cache (C:\Windows\assembly\) is loaded by a Microsoft Office application. This behavior can indicate an attempt to execute malicious code or achieve persistence through Office applications by leveraging .NET assemblies.
Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc). This rule specifically looks for `wmic.exe` loading scripting libraries like `jscript.dll` or `vbscript.dll`.
Detects PowerShell scripts that use the "Compress-Archive" Cmdlet to compress folders and files, storing the output in suspicious temporary locations often used by malware for exfiltration. Adversaries may compress collected data (e.g., sensitive documents) prior to exfiltration to make it portable and minimize network transfer.
Detects obfuscated PowerShell execution that leverages `clip.exe` to interact with the clipboard. The rule specifically looks for PowerShell module logs (Event ID 4103) where the payload contains `cmd` followed by `/c` or `/r`, then `clip` (with or without `.exe`), and finally a PowerShell command that accesses the clipboard using `[System.Windows.Forms.Clipboard]::SetText` or similar, often with string formatting. This technique is associated with `Invoke-Obfuscation`, a tool used to evade detection.
Detects the execution of PowerShell scripts obfuscated using techniques associated with Invoke-Obfuscation, specifically when launched via rundll32.exe and shell32.dll. This method is often used by adversaries to evade detection and execute malicious PowerShell code.
Page 493 of 680