SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects suspicious network scanning activity by identifying command-line executions that combine looping constructs ('for', 'foreach') with network discovery tools ('nslookup', 'ping'). This pattern is often used by adversaries to enumerate systems on a network for lateral movement or further reconnaissance.
Detects the pattern of User Account Control (UAC) Bypass using the ICMLuaUtil Elevated COM interface. This technique involves a specific parent process (dllhost.exe) launching with particular Process IDs associated with the ICMLuaUtil interface, which can be abused to elevate privileges without user interaction. The rule filters out legitimate WerFault.exe processes to reduce false positives.
This rule detects the use of 'w32tm.exe' with specific command-line arguments that allow it to act as a delay mechanism. Adversaries may leverage this legitimate Windows utility to introduce delays in their execution, potentially for sandbox evasion or to time their activities. The detected command-line arguments include '/stripchart', '/computer:', '/period:', '/dataonly', and '/samples:'.
Detects the execution of 'wermgr.exe' from an unusual or suspicious file path. Legitimate 'wermgr.exe' executions typically originate from 'C:\Windows\System32\', 'C:\Windows\SysWOW64\', or 'C:\Windows\WinSxS\'. Adversaries may rename or move legitimate Windows binaries to evade detection or blend in with normal system activity.
Detects the creation or modification of registry keys related to printer drivers that contain specific strings associated with Mimikatz or the PrinterNightmare vulnerability (CVE-2021-1675, CVE-2021-34527). The rule looks for 'QMS 810' or 'mimikatz' in printer driver paths, or a combination of 'legitprinter' and printer environment paths, or specific strings like 'Gentil Kiwi', 'mimikatz printer', or 'Kiwi Legit Printer' in registry objects related to printing.
Detects when an attacker modifies the 'Debugger' value within the 'AeDebug' registry key to establish persistence. This mechanism ensures that a specified malicious executable or DLL is launched whenever an application crashes, providing a persistent foothold on the system.
Detects attempts to disable Windows Defender Tamper Protection by modifying the relevant registry key. Tamper Protection is a security feature that prevents malicious programs from changing important security settings.
Detects when Windows developer features like "Developer Mode" or "Application Sideloading" are enabled by modifying specific registry keys. This allows users to install untrusted packages, potentially bypassing code signing requirements and enabling the execution of malicious applications.
This rule detects a User Account Control (UAC) bypass technique that leverages the Windows Event Viewer (eventvwr.exe). Specifically, it looks for modifications to the registry key `\mscfile\shell\open\command`. This registry key is associated with how .msc files (Microsoft Management Console snap-ins) are opened. By manipulating this key, an attacker can hijack the execution flow when eventvwr.exe is launched, causing it to execute an arbitrary command with elevated privileges without a UAC prompt. This is a known method for privilege escalation and defense evasion.
Detects when the 'AllowMultipleTSSessions' registry value is enabled, which allows for multiple Remote Desktop Protocol (RDP) sessions to be opened concurrently. Attackers often leverage this to maintain access to an RDP session without disconnecting other legitimate users, facilitating persistence and potentially defense evasion.
Page 527 of 680