SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects unauthorized access attempts to a resource.
This rule detects when user accounts are created or deleted in Azure Active Directory by users who are not on an approved list. It specifically looks for 'Add user' or 'Delete user' messages in the audit logs with a 'Success' status, and then filters out actions initiated by known, approved administrators.
This rule detects when a user is added to an administrator's role within Azure Active Directory. This is a critical event as it grants elevated privileges to the user, which could be abused for malicious purposes such as persistence, privilege escalation, or initial access. The detection specifically looks for 'Add member to role.' operations in AzureActiveDirectory workload where the new role value ends with 'Admins' or 'Administrator'.
Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob matching a pattern indicative of a marshaled CREDENTIAL_TARGET_INFORMATION structure. This pattern is commonly used in Kerberos coercion attacks where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests, such as in CVE-2025-33073. Investigation should focus on the user account making the changes, as it is likely a compromised low-privileged account.
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process. This rule specifically looks for the arubanetsvc.exe process loading specific DLLs (wtsapi32.dll, msvcr100.dll, msvcp100.dll, dbghelp.dll, dbgcore.dll, wininet.dll, iphlpapi.dll, version.dll, cryptsp.dll, cryptbase.dll, wldp.dll, profapi.dll, sspicli.dll, winsta.dll, dpapi.dll) from a location other than the standard Windows system directories (C:\Windows\System32\, C:\Windows\SysWOW64\, C:\Windows\WinSxS\). This behavior is indicative of DLL Search Order Hijacking, where an attacker places a malicious DLL in a directory that is searched before the legitimate system DLLs, causing the application to load the malicious version.
Detects the execution of "Setup16.EXE", an old installation utility, with a custom ".lst" file. These ".lst" files can contain references to external programs that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a Living Off The Land (LOLBIN) utility for various malicious purposes.
Detects communication to known Command and Control (C2) servers associated with the Equation Group, as identified in the operational notes from the ShadowBrokers leak. This rule specifically looks for network connections to or from the hardcoded IP addresses linked to Equation Group C2 infrastructure.
Detects the renaming of an existing computer account to an account name that doesn't contain a '$' symbol, which is a key indicator of the CVE-2021-42287 (SamAccountName Spoofing) attack. This technique is often used to impersonate a Domain Controller.
This rule detects the use of legacy authentication protocols for sign-ins to Azure AD. Legacy authentication protocols (such as POP3, IMAP, SMTP, MAPI, Exchange ActiveSync, Exchange Web Services, and 'Other client') do not support modern security features like Multi-Factor Authentication (MFA) and are often targeted by attackers for credential stuffing, brute-force attacks, and other credential-based attacks. Detecting and alerting on these sign-ins helps identify potential compromise or policy violations.
Detects calls to hidden files or files located in hidden directories in Linux systems. This rule specifically looks for file paths containing '/.' which is a common convention for hidden files and directories in Unix-like systems, while filtering out common legitimate hidden paths like '.cache' and '.config'.
Page 190 of 680