SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,494 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the execution of the 'whoami.exe' utility when its executable file name has been changed from the original 'whoami.exe'. Adversaries often rename legitimate system utilities to evade detection by security tools that monitor for specific process names. This technique is commonly used during the discovery phase to gather information about the compromised system's user context without triggering alerts associated with the standard 'whoami.exe' process name.
Detects suspicious execution of rundll32.exe without any command-line parameters, which is a known technique used by Cobalt Strike beacons for defense evasion. The rule specifically filters out common legitimate parent processes to reduce false positives.
This rule detects the execution of rundll32.exe with command-line arguments indicative of loading registered COM objects. Specifically, it looks for `rundll32.exe` processes where the command line contains both `{-sta` or `-localserver` and curly braces (`{`, `}`). This pattern is often used by adversaries to achieve persistence or privilege escalation by hijacking COM objects and executing malicious code through them.
This rule detects suspicious activity involving rundll32.exe launching runonce.exe with setupapi.dll and the InstallHinfSection function. This technique can be used by adversaries to achieve persistence by modifying registry run keys or executing arbitrary code via INF files, as setupapi.dll's InstallHinfSection function can call runonce.exe regardless of the INF file's content.
This rule detects the execution of `rundll32.exe` attempting to load `shell32.dll` with the `Control_RunDLL` function, specifically when the DLL is located in suspicious user-writable directories such as `AppData`, `LocalAppData`, `Temp`, or `Users\Public`. This behavior is often indicative of defense evasion techniques used by malware to execute malicious code from non-standard locations.
Detects suspicious activity where 'rundll32.exe' is used in the command line to invoke a '.sys' file. This behavior has been observed in attacks attributed to UNC2452 (NOBELIUM).
Detects the use of the 'sc.exe' utility to change the startup type of a Windows service to 'disabled' or 'demand'. This action can be used by adversaries to impair defenses or prevent legitimate services from starting.
Detects the creation of scheduled tasks by user accounts using the 'schtasks.exe' utility. This rule specifically looks for the execution of 'schtasks.exe' with the '/create' command-line argument, while filtering out activity from common system users to reduce false positives.
This rule detects the creation of unusual child processes originating from 'SndVol.exe', which is the legitimate Windows volume mixer. The rule specifically filters out 'rundll32.exe' when it's used with 'shell32.dll,Control_RunDLL', as this is a common and legitimate behavior. Any other child processes spawned by 'SndVol.exe' are considered suspicious and could indicate an attempt to hide malicious activity behind a legitimate process.
This rule detects the creation of a child process named 'choice' by 'setres.exe', which is an uncommon and potentially malicious behavior. Setres.exe is a legitimate Windows server tool used to set screen resolution, but it can be abused to launch arbitrary executables, especially those with 'choice' in their name, from the current execution path. The rule specifically filters out legitimate instances of 'choice.exe' located in 'C:\Windows\System32\' or 'C:\Windows\SysWOW64\'.
Page 581 of 680