SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,496 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of the PowerShell 'Write-EventLog' cmdlet in conjunction with the '-RawData' flag. This combination can be exploited by adversaries to embed malicious payloads within Windows Event Logs, which can then be retrieved later. This technique is often employed for defense evasion, allowing attackers to conceal their activities within seemingly legitimate system logs. Detection relies on PowerShell Script Block Logging being enabled.
Detects attempts to remove or modify Windows Defender configurations using the 'Remove-MpPreference' PowerShell cmdlet, specifically targeting settings like Controlled Folder Access and Attack Surface Reduction rules. This activity is indicative of an adversary trying to impair defensive capabilities.
Detects when a user disables the Windows Firewall via a PowerShell command targeting specific profiles (All, Public, Domain, or Private). This activity is often performed by adversaries to evade defense mechanisms and allow unauthorized network communication.
Detects process access events where the call trace contains 'cmlua.dll', which is indicative of Microsoft Connection Manager Profile Installer (CMSTP) execution. This activity can be abused by adversaries for code execution and UAC bypass.
Detects function calls from the EditionUpgradeManager COM interface, which is not typically used by standard executables. This activity can be indicative of a User Account Control (UAC) bypass attempt.
Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with uncommon Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.
Detects uncommon child processes spawned by Appvlp.EXE. Appvlp.EXE, or Application Virtualization Utility, is part of Microsoft Office and can be abused by attackers to execute shell commands, bypass ASR file path rules, or mark files as system files. This rule specifically looks for child processes that are not commonly associated with legitimate Appvlp.EXE operations, such as rundll32.exe, msoasb.exe, skypeserver.exe, and msouc.exe.
Detects the use of bitsadmin.exe to download files into suspicious or commonly abused folders such as temporary directories, program data, or user public folders. This technique is often used by adversaries for ingress tool transfer, defense evasion, and persistence.
Detects suspicious use of 'calc.exe' with command line parameters or when executed from a non-standard directory. This behavior is often associated with proof-of-concept exploits, malware, or detection evasion techniques where 'calc.exe' is used to test execution or as a decoy.
Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.
Page 574 of 680