SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,497 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of `regsvr32.exe` to load a DLL hosted on a remote network share. This technique is often used by adversaries for defense evasion and to bypass application control.
Detects attempts to tamper with the PowerShell execution policy by modifying registry keys via the command line. This technique is often used by adversaries to bypass script signing requirements, allowing the execution of unsigned or malicious PowerShell scripts.
Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance. This behavior is often associated with defense evasion techniques, where adversaries use legitimate Windows utilities to execute malicious code or bypass application whitelisting.
This rule detects the execution of Microsoft Office applications (Excel, Access, Publisher, OneNote, Outlook, PowerPoint, Word) when their executable files have been renamed. It identifies processes where the original file name or description indicates an Office application, but the executed image path does not match the standard, legitimate executable name for that application. This technique is often used by adversaries for defense evasion to bypass security controls that monitor known legitimate application names.
This rule detects the execution of the Remote Utilities (RURAT) legitimate remote administration tool when its executable name has been changed from its default names (rutserv.exe or rfusclient.exe). It identifies the tool by inspecting the 'Product' field in the PE header, which contains 'Remote Utilities', and then filters out the known legitimate executable names to catch instances where the file has been renamed, often as a defense evasion technique.
Detects the execution of 'rundll32.exe' when its parent process is 'explorer.exe'. This behavior has been observed in variants of the Raspberry Robin malware, as initially reported by Red Canary. The rule includes filters to reduce false positives from legitimate Windows operations, such as volume control.
This rule detects suspicious workstation locking activity initiated via rundll32.exe. Specifically, it looks for instances where rundll32.exe is the process image, its parent process is cmd.exe, and its command line contains both 'user32.dll,' and 'LockWorkStation'. This combination indicates an attempt to programmatically lock the workstation using a system binary proxy execution method, which can be abused by adversaries.
Detects the usage of 'schtasks.exe' with the '/delete' flag and the '/tn *' argument, which is used to delete all scheduled tasks on a local Windows system, including those created by other users. This activity can be indicative of an adversary attempting to disrupt system operations or remove forensic evidence.
Detects the creation of scheduled tasks using `schtasks.exe` that are configured to run once at exactly 00:00 and execute suspicious commands or scripts. The suspicious commands include common scripting engines (wscript, cscript, powershell), WMI, regsvr32, or executables located in the AppData directory. This pattern is often used by adversaries for persistence or execution at a specific, often stealthy, time.
Detects the use of stordiag.exe, a legitimate Windows utility, to execute other system binaries like schtasks.exe, systeminfo.exe, and fltmc.exe. This behavior can be indicative of an adversary attempting to bypass defenses by proxying execution through a trusted binary, a technique often associated with System Binary Proxy Execution (T1218). The rule specifically filters out executions where stordiag.exe is launched from its default system paths to reduce false positives, focusing on instances where it might be copied or used from non-standard locations.
Page 567 of 680