SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the execution of scheduled tasks that launch specific, potentially suspicious, Living Off The Land Binaries (LOLBINs) or other uncommon programs. The detection focuses on programs like calc.exe, cscript.exe, mshta.exe, mspaint.exe, notepad.exe, regsvr32.exe, and wscript.exe when they are initiated by the Task Scheduler. The intent is to identify potentially malicious activity where adversaries might use scheduled tasks for persistence, execution, or privilege escalation by leveraging legitimate system utilities in an unusual context.
Detects the addition of a Security Support Provider (SSP) to the Windows registry. When an SSP DLL is loaded into the Local Security Authority (LSA) process, typically upon system reboot or via an API call, it gains access to encrypted and plaintext passwords stored in Windows. This technique is often used for persistence and credential access.
Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows. EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process. This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions.
Detects the creation of suspicious files associated with Proof-of-Concept (PoC) exploits targeting the Windows Print Spooler Remote Code Execution Vulnerabilities, specifically CVE-2021-34527 (PrinterNightmare) and CVE-2021-1675. The rule looks for file creations within the ':\Windows\System32\spool\drivers\x64\' directory, which is a known location for files dropped by these exploits.
Detects the execution of 'curl.exe' with command-line arguments indicating the use of SOCKS proxies (socks5h, socks5, socks4a) and targeting '.onion' domains. This combination is highly indicative of activity associated with the Kalambur backdoor, which leverages TOR for command and control.
This rule detects interactive console logons (LogonType 2) to server systems and domain controllers. It specifically looks for successful (EventID 528, 4624) and failed (EventID 529, 4625) interactive logon attempts. The rule filters out events where the logon process name is 'Advapi' and the computer is a workstation, aiming to reduce false positives from legitimate workstation activities.
This rule detects the loading of known malicious drivers by their file names. Adversaries often use malicious drivers for persistence, privilege escalation, or to evade defenses. The rule specifically looks for a predefined list of driver filenames that have been identified as malicious or associated with vulnerable drivers exploited by attackers. This detection is based on the 'ImageLoaded' field, which indicates when a driver is loaded into the system.
Detects chromium-based browsers starting in headless and debugging mode while pointing to a user profile. This behavior can be indicative of data exfiltration, specifically cookie stealing, or remote control of the browser.
This rule identifies suspicious usage of the AWS Security Token Service (STS) `AssumeRole` API call. Specifically, it looks for instances where the `userIdentity.type` is `AssumedRole` and the `userIdentity.sessionContext.sessionIssuer.type` is `Role`. This pattern indicates that an AWS role is being assumed by another role, which could be a legitimate administrative action but also a technique used by attackers for lateral movement and privilege escalation within an AWS environment. Attackers might use `AssumeRole` to switch to roles with higher privileges or to move between different accounts or services after gaining initial access.
Detects when a temporary access pass (TAP) is added to an account in Azure AD. TAPs are a passwordless authentication method that can be used for onboarding, recovery, or as a strong credential. The addition of a TAP, especially to privileged accounts, should be investigated as it could indicate an attempt to gain or maintain unauthorized access.
Page 191 of 680