SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,499 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file when ie4uinit.exe is not run from its usual system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). This behavior is indicative of an adversary attempting to bypass defenses by proxying execution with a trusted system binary.
Detects the execution of "msdt.exe" with an answer file, specifically looking for command-line arguments that indicate the use of a diagnostic answer file (PCWDiagnostic.xml) and an answer file flag (-af or /af). This activity is suspicious because it bypasses the legitimate parent process "pcwrun.exe", which is typically used when MSDT is called from the compatibility tab.
Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability
Detects the execution of an executable by calling the 'LaunchApplication' function from the 'pcwutl.dll' library via 'rundll32.exe'. This technique is often used for defense evasion to proxy execution of malicious code.
This rule detects the use of 'rasautou.exe' to load and execute arbitrary DLLs. Adversaries can leverage 'rasautou.exe', a legitimate Windows utility, to proxy execution of malicious DLLs by specifying the DLL path with the '-d' option and an export function with the '-p' option. This technique is often used for defense evasion and to bypass application whitelisting. The rule specifically looks for the execution of 'rasautou.exe' or 'rasdlui.exe' with both '-d' and '-p' command-line arguments. This method is primarily relevant for Windows versions prior to Windows 10, as the '-d' and '-p' options were removed in later versions. For effective detection on Windows 7, Sysmon or KB3004375 for command-line auditing is required.
Detects the execution of 'runexehelper.exe' as a parent process, indicating its use as a proxy to launch other programs. This technique is often used for defense evasion by leveraging a legitimate, signed binary to execute malicious code.
This rule detects the creation of a new process where both the parent process and the new process are 'lsass.exe'. This behavior is highly suspicious and indicative of credential dumping techniques, specifically attempts to clone the LSASS process to extract credentials without directly interacting with the original LSASS process, which might be protected by security solutions.
This rule detects the execution of 'MSBuild.exe' when its parent process is not one of the commonly associated legitimate processes such as 'devenv.exe', 'cmd.exe', 'msbuild.exe' itself, 'python.exe', 'explorer.exe', or 'nuget.exe'. This behavior can indicate an adversary abusing MSBuild for code execution or defense evasion.
This rule detects the execution of JavaScript code using 'mshta.exe'. Mshta.exe is a legitimate Windows utility that can be abused by adversaries to proxy execution of malicious .hta files and JavaScript or VBScript, often to bypass application control solutions or browser security settings. The rule specifically looks for 'mshta.exe' as the image or original filename and the presence of 'javascript' in the command line arguments.
This rule detects suspicious execution patterns of mshta.exe, a Microsoft HTML Application host. It specifically looks for mshta.exe being spawned by common scripting or system utilities (cmd.exe, powershell.exe, cscript.exe, wscript.exe, regsvr32.exe, rundll32.exe) or when mshta.exe is executed from suspicious directories like AppData, ProgramData, Users\Public, or Windows\Temp. The rule also flags executions involving .htm or .hta files in the command line, while filtering out legitimate executions from System32 or SysWOW64 directories.
Page 562 of 680