SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the creation of processes from unusual and potentially suspicious locations on a Windows system. Specifically, it looks for executables being run from the 'RECYCLER' directory, 'SystemVolumeInformation' directory, or various subdirectories within 'C:\Windows\' that are not typically used for executable storage, such as 'Tasks', 'debug', 'fonts', 'help', 'drivers', 'addins', and 'cursors'. Adversaries often use these locations to hide malicious executables and evade detection.
This rule detects attempts to coerce NTLM authentication on the Printer Spooler service, which can be used for privilege escalation. Specifically, it looks for `rundll32.exe` executing with command-line arguments related to `davclnt.dll,DavSetCookie` and keywords like `spoolss`, `srvsvc`, or `/print/pipe/`, indicating an NTLM relay attack against the print spooler service.
Detects potential abuse of "ShellDispatch.dll" functionality to execute arbitrary binaries via "ShellExecute" using rundll32.exe. This technique involves rundll32.exe being executed with a command line containing 'RunDll_ShellExecuteW'.
This rule detects suspicious execution of rundll32.exe when its parent process is control.exe, specifically excluding cases where 'Shell32.dll' is present in the command line. This behavior has been observed in attacks by the Equation Group and exploit kits to load malicious DLLs via the Control Panel process, often as a defense evasion technique.
Detects the execution of Rundll32.exe where the command line contains file extensions commonly associated with image files. This behavior is suspicious as Rundll32.exe is typically used to execute DLL functions, and its use with image file extensions can indicate an attempt to masquerade malicious DLLs or scripts as benign image files to evade detection.
Detects the installation of a potentially suspicious new shim database using sdbinst.exe where the command line does not contain common, legitimate file extensions or flags. Adversaries may use application shimming for persistence or privilege escalation.
This rule detects the execution of the Windows built-in SoundRecorder.exe application when it is used with the '/FILE' command-line argument. This specific command-line argument indicates that SoundRecorder is being used to capture audio and save it to a file, which is a common technique used by attackers for audio surveillance.
This rule detects potential evasion or obfuscation attempts by identifying command lines that use bogus path traversal. Specifically, it looks for patterns like '\\..\\Windows\\', '\\..\\System32\\', or '\\..\\..\\' within the command line of processes whose image path contains '\\Windows\\'. It also flags command lines containing '.exe\\..\\' which could indicate an attempt to manipulate execution paths. The rule includes filters for known legitimate applications like Google Drive and Citrix that might exhibit similar behavior.
Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations. This technique is often used by adversaries to evade security controls that monitor execution from standard system paths.
Detects the use of the filename 'DumpStack.log' for a process image or in a command line when downloading, which is a known technique to evade Microsoft Defender. Adversaries may rename malicious executables to 'DumpStack.log' to bypass security controls that might ignore or whitelist files with this name, or use it as an output file name for downloads.
Page 543 of 680