SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.
Detects potential COM object hijacking via modification of default system CLSID.
Detects when an API access service account is granted domain authority within Google Workspace. This action can be used by an attacker to gain persistent and elevated access to an organization's Google Workspace data and services by allowing a service account to impersonate users across the domain.
Detects specific commands commonly used to remove or empty the syslog, a technique often used by attackers to hide their tracks. This rule identifies the use of utilities like 'rm', 'unlink', 'mv', 'truncate', 'ln', 'cp', 'shred', and 'journalctl' when their command lines target '/var/log/syslog' or perform actions that would clear syslog content.
PFX File Creation
Sigma
Detects the creation of PFX (Personal Information Exchange) files. PFX files contain private keys and certificates, making them high-value targets for attackers. Adversaries may create these files to exfiltrate digital certificates for impersonation, establish persistent access via certificate-based authentication, or bypass security controls. Analysts should investigate the process responsible for creating the PFX file, its parent process chain, and any unusual file locations outside of standard certificate stores or development environments.
Detects the use of various command-line utilities like PowerShell, curl, and wget to exfiltrate data via web requests, specifically looking for POST requests containing common system information or sensitive data commands.
This rule will collect the data needed to start looking into possible kerberoasting activity.
Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds.
You can then set a threshold for the number of requests and time between the requests to turn this into an alert.
Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds.
You can then set a threshold for the number of requests and time between the requests to turn this into an alert.
Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.
Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux. This includes using the `personality` syscall with the ADDR_NO_RANDOMIZE flag, modifying the `/proc/sys/kernel/randomize_va_space` file, or executing the `sysctl` command to set `kernel.randomize_va_space=0`. Disabling ASLR can be used by attackers to bypass memory protection mechanisms and make memory corruption attacks more reliable, often during exploit development.
Page 183 of 680