SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,505 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the creation of suspicious file types (e.g., executables, scripts, archives) within the `C:\PerfLogs\` directory. This directory is typically used for performance logs and primarily contains `.etl` files. The presence of other executable or script file types in this location is highly unusual and can indicate malicious activity, such as staging for execution, persistence, or data exfiltration.
Detects when legitimate Windows applications, including Microsoft Office programs and various Living Off The Land Binaries (LOLBINs), create archive files (ZIP, RAR, 7Z, diagcab, appx). This behavior is often indicative of malicious activity, such as staging data for exfiltration or dropping malicious payloads, as these applications typically should not be creating archives.
This rule detects the creation of the Process Monitor (procmon) driver file (.sys) by any process other than the legitimate Process Monitor executable itself (procmon.exe or procmon64.exe). This behavior can indicate an attempt to load a malicious or unauthorized driver, potentially for privilege escalation or persistence, by masquerading as a legitimate system utility.
Detects the creation of the PSEXEC key file, which is generated whenever a PsExec command is executed. This file is written to the file system and recorded in the USN Journal on the target system, serving as an indicator of PsExec activity.
Detects the creation or modification of 'WsmPty.xsl' or 'WsmTxt.xsl' files outside of the standard Windows system directories. This activity is indicative of an application whitelisting bypass technique involving 'winrm.vbs' and 'cscript.exe' to execute attacker-controlled XSL files.
This rule detects when 'credui.dll' or 'wincredui.dll' is loaded by a process that is not commonly associated with these DLLs. Attackers might load these DLLs to interact with Windows Credential Provider functions like 'CredUIPromptForCredentials' or 'CredUnPackAuthenticationBufferW' to prompt users for credentials or extract them.
Detects processes loading modules related to the PCRE.NET package, specifically looking for a unique temporary path often associated with its deployment. This could indicate the execution of code leveraging this package, potentially for malicious purposes like regular expression-based obfuscation or payload delivery.
Detects the loading of a DLL associated with the SILENTTRINITY stager, specifically looking for the string 'st2stager' in the DLL's description.
This rule detects when an unsigned image (DLL or EXE) is loaded into the Local Security Authority Subsystem Service (LSASS) process. Adversaries often inject malicious, unsigned code into LSASS to dump credentials, as LSASS stores sensitive authentication material. Detecting unsigned code in this critical process can indicate an attempt at credential dumping or other forms of privilege escalation.
Detects a potential DLL hijack involving 'iertutil.dll' when loaded by 'iexplore.exe' within the context of the DCOM InternetExplorer.Application Class. This could indicate an adversary attempting to execute malicious code by manipulating the DLL search order or substituting a legitimate DLL.
Page 515 of 680