SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,494 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the creation of new processes where the parent process is `taskmgr.exe`. This activity could indicate an attempt to bypass User Account Control (UAC) by leveraging the Windows Task Manager, which is often auto-elevated. The rule filters out common legitimate processes that `taskmgr.exe` might launch, such as `mmc.exe`, `resmon.exe`, and `Taskmgr.exe` itself, to reduce false positives.
This rule detects the execution of the 'TpmVscMgr.exe' utility with the 'create' command-line argument, indicating the creation of a new virtual smart card. This activity can be legitimate for system administration but could also be leveraged by adversaries for persistence or to bypass authentication mechanisms.
Bypass UAC via CMSTP
Sigma
Detects command-line usage of Microsoft Connection Manager Profile Installer (cmstp.exe) with specific flags often used to install specially formatted local .INF files for privilege escalation or defense evasion. This technique is commonly associated with UAC bypasses.
Detects a User Account Control (UAC) bypass technique that leverages the Event Viewer's RecentViews functionality. This method involves manipulating the RecentViews file to execute arbitrary code with elevated privileges without triggering a UAC prompt. The rule specifically looks for command-line arguments that reference 'Event Viewer\RecentViews' or 'EventV~1\RecentViews' in conjunction with a redirection operator ('>'), indicating an attempt to write to or modify this file.
Detects the use of WSReset.exe to bypass User Account Control (UAC). This technique allows adversaries to execute privileged processes without a UAC prompt.
This rule detects attempts to list credentials stored in the Windows Credential Manager using the native Windows utility `vaultcmd.exe`. Specifically, it looks for process creation events where `VaultCmd.exe` is executed with the `/listcreds:` command-line argument, indicating an attempt to enumerate stored credentials.
Detects execution of "VSDiagnostics.exe" with the "start" or "launch" command-line arguments to proxy the execution of arbitrary binaries. This technique can be used by adversaries to bypass defenses by leveraging a legitimate, signed Microsoft binary.
Detects Microsoft Visual Studio vsls-agent.exe execution with a suspicious library load using the --agentExtensionPath parameter. This technique can be used to proxy execution of malicious code by abusing a legitimate signed binary.
This rule detects unusual parent or child processes associated with `wab.exe` (Windows Contacts) and `wabmig.exe` (Microsoft Address Book Import Tool). These processes are typically not involved in spawning other processes or being spawned by unusual parents. The rule specifically looks for `wab.exe` or `wabmig.exe` being spawned by `WmiPrvSE.exe`, `svchost.exe`, or `dllhost.exe`, or if `wab.exe` or `wabmig.exe` themselves spawn any child processes. This behavior has been observed in connection with Bumblebee loader activity, indicating potential malicious execution or defense evasion.
Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands. This activity is often associated with webshells attempting to understand the capabilities of the compromised server.
Page 583 of 680