SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects user sign-ins occurring outside of predefined normal business hours and from locations not explicitly whitelisted. This rule aims to identify potentially unauthorized access attempts or compromised accounts being used at unusual times or from unexpected geographies.
Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This behavior has been associated with exploitation of WinRAR path traversal vulnerabilities like CVE-2025-6218 or CVE-2025-8088.
This rule detects potential Pass the Hash (PtH) activity by monitoring Windows Security Event IDs 4624 (successful logon) and 4625 (failed logon) where the LogonType is 3 (Network) and the LogonProcessName is 'NtLmSsp'. It specifically filters out 'ANONYMOUS LOGON' to reduce false positives. This combination of events indicates an attempt to authenticate over the network using NTLM, which is characteristic of PtH attacks for lateral movement.
Detects potentially suspicious events involving "GetSigninToken" in AWS. An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credentials, which can help obfuscate the compromised AWS credential (the original access key) and enable pivoting from the AWS CLI to console sessions without requiring MFA, using the newly issued access key.
This rule detects when multi-factor authentication (MFA) has been explicitly disabled for a user in Azure Active Directory. This activity could indicate an adversary attempting to bypass authentication mechanisms to gain unauthorized access or maintain persistence.
Detects suspicious child processes spawned by 'SpeechRuntime.exe'. This activity is indicative of potential lateral movement attempts, specifically through COM & DCOM hijacking, where 'SpeechRuntime.exe' is abused as a proxy for execution.
Detects the possible addition of shadow credentials to an Active Directory object by monitoring for Event ID 5136 (Directory Service Changes) where the 'msDS-KeyCredentialLink' attribute is modified. This attribute is used in shadow credential attacks to establish persistence and gain unauthorized access.
Detects when an instance identity has taken an action that isn't inside SSM.
This can indicate that a compromised EC2 instance is being used as a pivot point.
This can indicate that a compromised EC2 instance is being used as a pivot point.
Detects successful authentication attempts originating from clients using legacy authentication methods, identifiable via specific user agent strings. This activity can indicate an adversary attempting to bypass multi-factor authentication (MFA), potentially as part of a password spray attack. Legacy authentication protocols often do not support modern MFA mechanisms, making them a target for attackers who have obtained valid credentials through other means or are performing brute-force attacks like password spraying.
Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.
Page 186 of 680