SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 which involves unauthorized code execution via WebDAV through external control of file names or paths. The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe by manipulating their working directories to point to attacker-controlled WebDAV servers, causing them to execute malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries through Process.Start() search order manipulation.
Detects modifications to critical Unix shell configuration files. Adversaries may modify these files to establish persistence or elevate privileges by executing malicious commands when a new shell is opened or a user logs in.
This rule detects the creation or modification of a specific registry run key used by the Leviathan APT group for persistence. The key path observed is '\Software\Microsoft\Windows\CurrentVersion\Run\ntkd'. This indicates that a program named 'ntkd' is configured to execute automatically when a user logs in, a common technique for maintaining access to a compromised system.
Detects potential suspicious behavior using secedit.exe, specifically when it is used to export or configure security policies. This could indicate an adversary attempting to discover system configurations or modify them for persistence, defense evasion, or privilege escalation.
Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential exploitation of a vulnerability, such as CVE-2025-31324, allowing arbitrary code execution via webshells. The rule specifically looks for common command-line interpreters and scripting engines being launched from SAP NetWeaver's application directories.
Detects successful sign-ins by privileged role accounts that occur outside of normal business hours or from unusual geographic locations. This rule is designed to flag potentially suspicious activity that could indicate compromised credentials or insider threat activity, especially for administrative accounts.
Detects the loading of the "taskschd.dll" module from a process that is located in a potentially suspicious or uncommon directory. The loading of this DLL might indicate that the application has the capability to create a scheduled task via the "Schedule.Service" COM object. Investigation of the loading application and its behavior is required to determine if it is malicious.
Identifies when a user grants permissions to another user on Azure resources. The rule specifically looks for the 'Microsoft.Authorization/roleAssignments/write' operation in Azure Activity Logs, which indicates a role assignment creation or modification. This can be an indicator of privilege escalation or persistence.
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. This can be used by adversaries for persistence, privilege escalation, or defense evasion.
Detects the installation of a Windows service by the Sliver C2 framework. This rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, combined with an ImagePath characteristic of Sliver (an executable in the Windows temporary directory with a 10-character alphanumeric name) or a ServiceName explicitly identifying as 'Sliver' or 'Sliver implant'. This behavior is often observed when Sliver implants use tools like PsExec to establish persistence.
Page 193 of 680