SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the creation of executable files (.exe) within the `C:\Windows\WinSxS\` directory by processes that are not located in standard system directories (`C:\Windows\Systems32\`, `C:\Windows\SysWOW64\`, or `C:\Windows\WinSxS\`). This behavior can be indicative of malware attempting to establish persistence or execute from a less commonly monitored system directory, potentially mimicking legitimate system components.
Detects the creation of a file named 'livekd.dmp' in the 'C:\Windows\' directory, which is the default output file for LiveKD kernel memory dumps. This activity can indicate an attempt to perform live kernel debugging, potentially for privilege escalation or defense evasion purposes.
Detects the creation of Process Explorer drivers by processes other than Process Explorer itself. This activity can indicate that hack tools or malware are attempting to use the Process Explorer driver for privilege escalation, often by dropping the driver to disk, running a service with it, and then removing it.
Detects the creation of a DLL file by "dllhost.exe" in the System32 directory, which is indicative of the "IDiagnosticProfileUAC" UAC bypass technique. This technique leverages a legitimate Windows process to write a malicious DLL into a system directory, allowing for privilege escalation.
Detects a User Account Control (UAC) bypass technique that leverages the Windows Event Viewer (eventvwr.exe). This method involves manipulating the registry to execute an arbitrary binary or script with elevated privileges when eventvwr.exe is launched. The rule specifically looks for file creation events in the 'RecentViews' directory associated with Event Viewer, where the creating process is not a standard system process (i.e., not originating from C:\Windows\System32\ or C:\Windows\SysWOW64\).
Detects the creation of specific files (winsat.exe or winmm.dll) in a user's temporary directory under a 'system32' subdirectory. This pattern is indicative of a User Account Control (UAC) bypass technique that exploits a path parsing vulnerability in winsat.exe, often associated with UACMe (specifically UACMe method 52). The rule looks for files created in 'C:\Users\<username>\AppData\Local\Temp\system32\' with the names 'winsat.exe' or 'winmm.dll'.
Detects when 'rundll32.exe' attempts to load a DLL from a remote network path (e.g., a UNC path starting with '\\'). This behavior is often indicative of malicious activity, as legitimate rundll32.exe usage typically involves loading local DLLs.
Detects when a Microsoft Office application (Excel, Publisher, OneNote, Outlook, PowerPoint, Word) loads specific Visual Basic for Applications (VBA) related DLLs (VBE7.DLL, VBEUI.DLL, VBE7INTL.DLL). This activity can indicate the presence and execution of VBA macros, which are often used by adversaries for initial access or execution.
Detects network connections to the Notion API (api.notion.com) from processes that are not recognized legitimate Notion applications or common web browsers. This rule aims to identify potential covert command and control (C2) channels, specifically referencing tools like "OffensiveNotion C2" which leverage Notion's infrastructure for malicious communication.
Detects the creation of a named pipe with the default name used by RemCom, a legitimate remote administration tool that can be abused by attackers for lateral movement and execution.
Page 529 of 680