Rule Library

Sigma Rules

1,585 rules found for "defense-evasion"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionhightest

UAC Bypass Tools Using ComputerDefaults

Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548.002 · Bypass User Account Control
Christian Burkard (Nextron Systems)Tue Aug 31windows
Detectionhightest

UAC Bypass Using Consent and Comctl32 - Process

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548.002 · Bypass User Account Control
Christian Burkard (Nextron Systems)Mon Aug 23windows
Detectionhightest

UAC Bypass Using DismHost

Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548.002 · Bypass User Account Control
Christian Burkard (Nextron Systems)Mon Aug 30windows
Detectionhightest

UAC Bypass Using Event Viewer RecentViews

Detects the pattern of UAC Bypass using Event Viewer RecentViews

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege Escalation
Nasreddine Bencherchali (Nextron Systems)Tue Nov 22windows
Detectionhightest

Bypass UAC via Fodhelper.exe

Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548.002 · Bypass User Account Control
E.M. Anhaus (originally from Atomic Blue Detections+2Thu Oct 24windows
Detectionmediumtest

UAC Bypass via Windows Firewall Snap-In Hijack

Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548 · Abuse Elevation Control Mechanism
Tim Rauch+1Tue Sep 27windows
Detectionhightest

UAC Bypass via ICMLuaUtil

Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548.002 · Bypass User Account Control
Florian Roth (Nextron Systems)+1Tue Sep 13windows
Detectionhightest

UAC Bypass Using IDiagnostic Profile

Detects the "IDiagnosticProfileUAC" UAC bypass technique

WindowsProcess Creation
TA0002 · ExecutionTA0005 · Defense EvasionTA0004 · Privilege EscalationT1548.002 · Bypass User Account Control
Nasreddine Bencherchali (Nextron Systems)Sun Jul 03windows
Detectionhightest

UAC Bypass Using IEInstal - Process

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548.002 · Bypass User Account Control
Christian Burkard (Nextron Systems)Mon Aug 30windows
Detectionhightest

UAC Bypass Using MSConfig Token Modification - Process

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548.002 · Bypass User Account Control
Christian Burkard (Nextron Systems)Mon Aug 30windows
Detectionhightest

UAC Bypass Using NTFS Reparse Point - Process

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548.002 · Bypass User Account Control
Christian Burkard (Nextron Systems)Mon Aug 30windows
Detectionhightest

UAC Bypass Using PkgMgr and DISM

Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548.002 · Bypass User Account Control
Christian Burkard (Nextron Systems)Mon Aug 23windows
Detectionmediumtest

Potential UAC Bypass Via Sdclt.EXE

A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.

WindowsProcess Creation
TA0004 · Privilege EscalationTA0005 · Defense EvasionT1548.002 · Bypass User Account Control
Roberto Rodriguez (Cyb3rWard0g)+1Sat May 02windows
Detectioncriticaltest

TrustedPath UAC Bypass Pattern

Detects indicators of a UAC bypass method by mocking directories

WindowsProcess Creation
TA0004 · Privilege EscalationTA0005 · Defense EvasionT1548.002 · Bypass User Account Control
Florian Roth (Nextron Systems)Fri Aug 27windows
Detectionhightest

UAC Bypass Abusing Winsat Path Parsing - Process

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548.002 · Bypass User Account Control
Christian Burkard (Nextron Systems)Mon Aug 30windows
Detectionhightest

UAC Bypass Using Windows Media Player - Process

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548.002 · Bypass User Account Control
Christian Burkard (Nextron Systems)Mon Aug 23windows
Detectionhightest

Bypass UAC via WSReset.exe

Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

WindowsProcess Creation
TA0004 · Privilege EscalationTA0005 · Defense EvasionT1548.002 · Bypass User Account Control
E.M. Anhaus (originally from Atomic Blue Detections+3Thu Oct 24windows
Detectionhightest

UAC Bypass WSReset

Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548.002 · Bypass User Account Control
Christian Burkard (Nextron Systems)Mon Aug 23windows
Detectionhightest

Uninstall Crowdstrike Falcon Sensor

Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon

WindowsProcess Creation
TA0005 · Defense EvasionT1562.001 · Disable or Modify Tools
François HubautMon Jul 12windows
Detectionhighexperimental

User Shell Folders Registry Modification via CommandLine

Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts. Attackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup. This technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.

WindowsProcess Creation
TA0003 · PersistenceTA0004 · Privilege EscalationT1547.001 · Registry Run Keys / Startup FolderTA0005 · Defense Evasion+1
Swachchhanda Shrawan Poudel (Nextron Systems)Mon Jan 05windows
Detectionmediumexperimental

Registry Modification Attempt Via VBScript

Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods via common LOLBINs. It could be an attempt to modify the registry for persistence without using straightforward methods like regedit.exe, reg.exe, or PowerShell. Threat Actors may use this technique to evade detection by security solutions that monitor for direct registry modifications through traditional tools.

WindowsProcess Creation
TA0005 · Defense EvasionTA0003 · PersistenceTA0002 · ExecutionT1112 · Modify Registry+1
Swachchhanda Shrawan Poudel (Nextron Systems)Wed Aug 13windows
Detectionmediumtest

Verclsid.exe Runs COM Object

Detects when verclsid.exe is used to run COM object via GUID

WindowsProcess Creation
TA0005 · Defense EvasionT1218 · System Binary Proxy Execution
Victor Sergeev+1Fri Oct 09windows
Detectionlowtest

Virtualbox Driver Installation or Starting of VMs

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

WindowsProcess Creation
TA0005 · Defense EvasionT1564.006 · Run Virtual InstanceT1564 · Hide Artifacts
Janantha MarasingheSat Sep 26windows
Detectionmediumtest

Suspicious VBoxDrvInst.exe Parameters

Detect VBoxDrvInst.exe run with parameters allowing processing INF file. This allows to create values in the registry and install drivers. For example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys

WindowsProcess Creation
TA0003 · PersistenceTA0005 · Defense EvasionT1112 · Modify Registry
Konstantin Grishchenko+1Tue Oct 06windows
Detectionmediumtest

Potentially Suspicious Child Process Of VsCode

Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.

WindowsProcess Creation
TA0002 · ExecutionTA0005 · Defense EvasionT1218 · System Binary Proxy ExecutionT1202 · Indirect Command Execution
Nasreddine Bencherchali (Nextron Systems)Thu Jan 26windows
Detectionmediumtest

Potential Binary Proxy Execution Via VSDiagnostics.EXE

Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries.

WindowsProcess Creation
TA0005 · Defense EvasionT1218 · System Binary Proxy Execution
Nasreddine Bencherchali (Nextron Systems)Thu Aug 03windows
Detectionmediumexperimental

Proxy Execution via Vshadow

Detects the invocation of vshadow.exe with the -exec parameter that executes a specified script or command after the shadow copies are created but before the VShadow tool exits. VShadow is a command-line tool that you can use to create and manage volume shadow copies. While legitimate backup or administrative scripts may use this flag, attackers can leverage this parameter to proxy the execution of malware.

WindowsProcess Creation
TA0005 · Defense EvasionT1202 · Indirect Command Execution
David FaissMon May 26windows
Detectionmediumtest

Suspicious Vsls-Agent Command With AgentExtensionPath Load

Detects Microsoft Visual Studio vsls-agent.exe lolbin execution with a suspicious library load using the --agentExtensionPath parameter

WindowsProcess Creation
TA0005 · Defense EvasionT1218 · System Binary Proxy Execution
bohopsSun Oct 30windows
Detectionhighexperimental

Vulnerable Driver Blocklist Registry Tampering Via CommandLine

Detects tampering of the Vulnerable Driver Blocklist registry via command line tools such as PowerShell or REG.EXE. The Vulnerable Driver Blocklist is a security feature that helps prevent the loading of known vulnerable drivers. Disabling this feature may indicate an attempt to bypass security controls, often targeted by threat actors to facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response

WindowsProcess Creation
TA0005 · Defense EvasionT1562.001 · Disable or Modify Tools
Swachchhanda Shrawan Poudel (Nextron Systems)Mon Jan 26windows
Detectionhightest

Wab Execution From Non Default Location

Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default locations as seen with bumblebee activity

WindowsProcess Creation
TA0005 · Defense EvasionTA0002 · Execution
Nasreddine Bencherchali (Nextron Systems)Fri Aug 12windows
Detectionhightest

Wab/Wabmig Unusual Parent Or Child Processes

Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) processes as seen being used with bumblebee activity

WindowsProcess Creation
TA0005 · Defense EvasionTA0002 · Execution
Nasreddine Bencherchali (Nextron Systems)Fri Aug 12windows
Detectionmediumtest

Potential ReflectDebugger Content Execution Via WerFault.EXE

Detects execution of "WerFault.exe" with the "-pr" commandline flag that is used to run files stored in the ReflectDebugger key which could be used to store the path to the malware in order to masquerade the execution flow

WindowsProcess Creation
TA0002 · ExecutionTA0005 · Defense EvasionT1036 · Masquerading
X__Junior (Nextron Systems)Fri Jun 30windows
Detectionhighexperimental

PPL Tampering Via WerFaultSecure

Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software. Distinct command line patterns help identify the specific tool: - WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine - EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.

WindowsProcess Creation
TA0005 · Defense EvasionT1562.001 · Disable or Modify ToolsTA0006 · Credential AccessT1003.001 · LSASS Memory
Jason (https://github.com/0xbcf)Tue Sep 23windows
Detectionhightest

Suspicious Child Process Of Wermgr.EXE

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1055 · Process InjectionT1036 · Masquerading
Florian Roth (Nextron Systems)Fri Oct 14windows
Detectionmediumtest

Add New Download Source To Winget

Detects usage of winget to add new additional download sources

WindowsProcess Creation
TA0005 · Defense EvasionTA0002 · ExecutionT1059 · Command and Scripting Interpreter
Nasreddine Bencherchali (Nextron Systems)Mon Apr 17windows
Detectionhightest

Add Insecure Download Source To Winget

Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)

WindowsProcess Creation
TA0005 · Defense EvasionTA0002 · ExecutionT1059 · Command and Scripting Interpreter
Nasreddine Bencherchali (Nextron Systems)Mon Apr 17windows
Detectionmediumtest

Add Potential Suspicious New Download Source To Winget

Detects usage of winget to add new potentially suspicious download sources

WindowsProcess Creation
TA0005 · Defense EvasionTA0002 · ExecutionT1059 · Command and Scripting Interpreter
Nasreddine Bencherchali (Nextron Systems)Mon Apr 17windows
Detectionmediumtest

Install New Package Via Winget Local Manifest

Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be used to download and install exe, msi or msix files later.

WindowsProcess Creation
TA0005 · Defense EvasionTA0002 · ExecutionT1059 · Command and Scripting Interpreter
Sreeman+2Tue Apr 21windows
Detectionmediumtest

AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl

Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

WindowsProcess Creation
TA0005 · Defense EvasionT1216 · System Script Proxy Execution
Julia Fomina+1Tue Oct 06windows
Detectionmediumtest

Remote Code Execute via Winrm.vbs

Detects an attempt to execute code or create service on remote host via winrm.vbs.

WindowsProcess Creation
TA0005 · Defense EvasionT1216 · System Script Proxy Execution
Julia Fomina+1Wed Oct 07windows
Detectionhighexperimental

Winrs Local Command Execution

Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.

WindowsProcess Creation
TA0008 · Lateral MovementTA0005 · Defense EvasionT1021.006 · Windows Remote ManagementT1218 · System Binary Proxy Execution
Liran Ravich+1Wed Oct 22windows
Detectionmediumexperimental

Wlrmdr.EXE Uncommon Argument Or Child Process

Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argument of the ShellExecute API, which would allow an attacker to execute arbitrary binaries. This detection also focuses on any uncommon child processes spawned from "Wlrmdr.exe" as a supplement for those that posses "ParentImage" telemetry.

WindowsProcess Creation
TA0005 · Defense EvasionT1218 · System Binary Proxy Execution
François Hubaut+1Wed Feb 16windows
Detectionhightest

Potential Windows Defender Tampering Via Wmic.EXE

Detects potential tampering with Windows Defender settings such as adding exclusion using wmic

WindowsProcess Creation
TA0005 · Defense EvasionTA0002 · ExecutionT1047 · Windows Management InstrumentationT1562 · Impair Defenses
François HubautSun Dec 11windows
Detectionhightest

Potential Remote SquiblyTwo Technique Execution

Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI) to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript. The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.

WindowsProcess Creation
TA0005 · Defense EvasionT1047 · Windows Management InstrumentationT1220 · XSL Script ProcessingTA0002 · Execution+2
Markus Neis+2Wed Jan 16windows
Detectionmediumexperimental

Registry Manipulation via WMI Stdregprov

Detects the usage of wmic.exe to manipulate Windows registry via the WMI StdRegProv class. This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe. Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.

WindowsProcess Creation
TA0003 · PersistenceTA0002 · ExecutionTA0005 · Defense EvasionTA0007 · Discovery+3
Daniel Koifman (KoifSec)Wed Jul 30windows
Detectionhightest

Suspicious WMIC Execution Via Office Process

Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).

WindowsProcess Creation
T1204.002 · Malicious FileT1047 · Windows Management InstrumentationT1218.010 · Regsvr32TA0002 · Execution+1
Vadim Khrykov+1Mon Aug 23windows
Detectionhightest

Potential Tampering With Security Products Via WMIC

Detects uninstallation or termination of security products using the WMIC utility

WindowsProcess Creation
TA0005 · Defense EvasionT1562.001 · Disable or Modify Tools
Florian Roth (Nextron Systems)+1Sat Jan 30windows
Detectionmediumtest

XSL Script Execution Via WMIC.EXE

Detects the execution of WMIC with the "format" flag to potentially load local XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

WindowsProcess Creation
TA0005 · Defense EvasionT1047 · Windows Management InstrumentationT1220 · XSL Script ProcessingTA0002 · Execution+2
Timur Zinniatullin+2Mon Oct 21windows