SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the installation of the 'Remote Utilities - Host' service on a Windows system. It specifically looks for Event ID 7045 from the 'Service Control Manager' provider, which indicates a service installation. The detection is further refined by checking for the presence of 'rutserv.exe' and '-service' in the ImagePath, or the exact service name 'Remote Utilities - Host'. This activity is often associated with remote access tools, which can be used legitimately for IT administration but also by adversaries for persistence and remote control.
This rule detects the installation of a TAP (Tunnel Adapter) driver, specifically looking for 'tap0901' in the service's ImagePath. TAP drivers are commonly used by VPN software like OpenVPN to create virtual network interfaces, which can be leveraged for tunneling and data exfiltration. The detection aims to identify potential preparation for data exfiltration using tunneling techniques.
This rule detects the creation of new Windows services with suspicious or uncommon image paths. It specifically looks for paths containing references to named pipes, common temporary directories like `Users\Public\` or `Windows\Temp\`, or image paths that include patterns indicative of encoded PowerShell commands (e.g., `-e` followed by specific base64 encoded strings). This behavior is often associated with adversaries establishing persistence or escalating privileges by creating malicious services.
This rule detects the termination of important Windows services, such as antivirus, firewall, Microsoft Defender components, BitLocker, and Encrypting File System (EFS). It specifically looks for Event ID 7023 from the 'Service Control Manager' provider, indicating a service termination with an error. The rule identifies critical services by their display names (which can be language-specific) or by their wide hex-encoded service names in the 'Binary' field of the event.
Detects when the grace period for Windows Defender expires, indicating that protection against viruses, spyware, and other potentially unwanted software is disabled. This event suggests a critical security control has been impaired.
Detects when an attempt is made to add or remove applications or folders from Windows Defender Exploit Guard's "ProtectedFolders" or "AllowedApplications" configurations. This could indicate an adversary trying to bypass Controlled Folder Access protections.
Detects when the 'Automatic Sample Submission' feature of Windows Defender is disabled. This is indicated by a change in the antimalware platform configuration, specifically setting the 'SubmitSamplesConsent' registry value to '0x0'. Adversaries may disable this feature to prevent security products from submitting malicious samples for analysis, thereby hindering detection and analysis efforts.
This rule detects when Windows Defender logs the deletion of its malware detection history. This action can be performed by an attacker to remove traces of their activity or to prevent the system from reporting previously detected malware.
Detects when the Windows Defender feature for scanning malware and potentially unwanted software is disabled. This is indicated by Event ID 5010 from the WinDefend service.
This rule detects attempts by PowerShell processes (powershell.exe or pwsh.exe) to create a remote thread in the Local Security Authority Subsystem Service (LSASS) process. This activity is a common technique used by adversaries to dump credentials from memory.
Page 504 of 680