SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects usage of the Windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack referred to as PetitPotam. The usage of this RPC function should be rare if ever used at all. Thus, any usage of this function is uncommon enough that it should warrant further investigation to determine if it is legitimate. View surrounding logs (within a few minutes before and after) from the Source IP to determine if it is legitimate. Logs from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc.
Detects the creation of remote scheduled tasks by monitoring access to the 'atsvc' named pipe over SMB. This activity is indicative of using tools like 'at.exe' or direct API calls to schedule tasks on a remote system, which can be leveraged for privilege escalation, execution, lateral movement, or persistence.
This rule detects successful remote logons by users whose usernames start with 'Admin' (e.g., Administrator, Admin-SQL) on Windows systems. It specifically looks for Event ID 4624 (successful logon), Logon Type 10 (RemoteInteractive), and the Negotiate authentication package. The rule aims to identify potential misuse of administrative accounts for remote access, which could indicate privilege escalation, persistence, or lateral movement. Its effectiveness relies on an internal pattern for administrator usernames and a policy mandating that these accounts are only used as secondary accounts.
This rule detects suspicious child processes spawned by 'msra.exe' (Microsoft Remote Assistance). Adversaries have been observed using msra.exe for process injection, discovery, and persistence. The rule specifically looks for common command-line utilities being executed as child processes of msra.exe, which could indicate malicious activity.
This rule detects when Privileged Identity Management (PIM) alerts are disabled within Azure. Disabling PIM alerts can be a defense evasion tactic, as it prevents security teams from being notified of critical activities related to privileged roles, potentially allowing an attacker to operate undetected after gaining initial access or escalating privileges.
This rule detects attempts to enable auditing of TTY input on Linux systems by monitoring modifications to PAM (Pluggable Authentication Modules) configuration files. Specifically, it looks for changes to '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth' in conjunction with TTY-related audit events. This activity could indicate an adversary attempting to implement keylogging functionality using the pam_tty_audit module to capture user input.
Detects when a modification (create, update, replace, delete, or patch) action is taken that affects mutating or validating webhook configurations in Kubernetes. Adversaries can abuse these configurations to achieve persistence, exfiltrate credentials, or escalate privileges within the cluster.
Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
This rule detects the execution of tools designed for Parent Process ID (PPID) spoofing, specifically targeting Didier Stevens' 'SelectMyParent' tool. It identifies these tools through their executable name, specific command-line arguments, original file names, and known IMPHASH values. PPID spoofing is a defense evasion technique where a new process is created with a manipulated parent process ID to obscure its true origin, often to bypass security monitoring or elevate privileges.
Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks. Specifically, it looks for Velociraptor spawning 'code.exe' with tunneling arguments, 'msiexec' with '/i' and 'http' for remote installation, or PowerShell/pwsh executing web requests or file downloads.
Page 192 of 680