SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Monitors for successful device registration or join events in Azure AD where Multi-Factor Authentication (MFA) was not performed. This could indicate an adversary bypassing MFA to gain persistent access or escalate privileges by registering a new device.
Detects successful RDP logons originating from public IP addresses. This can indicate an exposed RDP port being accessed externally, potentially by an attacker.
This rule detects the remote creation of scheduled tasks by monitoring access to the 'ATSVC' named pipe within the IPC$ share. Specifically, it looks for Event ID 5145, indicating a detailed file share access, where the ShareName is '\\*\IPC$', the RelativeTargetName is 'atsvc', and the AccessList contains 'WriteData'. This activity is characteristic of tools like 'at.exe' or direct API calls used to schedule tasks remotely.
Detects the load of the WinRing0 driver, which is known to be vulnerable and has been exploited by threat actors, crypto miners (like XMRIG), and other malware for privilege escalation. The detection is based on specific file names or a known IMPHASH associated with the driver.
This rule detects uncommon outbound network connections on TCP port 88, which is the default port for Kerberos. Such activity, especially from processes other than expected system services like LSASS or common applications like web browsers and Tomcat, can indicate potential lateral movement or initial privilege escalation attempts through Kerberos delegation. Attackers often leverage Kerberos for authentication in Windows environments to move between systems or elevate privileges, for example, using tools like Rubeus for Kerberoasting or other Kerberos-based attacks.
This rule detects the execution of Kali Linux through Windows Subsystem for Linux (WSL). It identifies processes whose image paths contain typical Kali Linux installation directories within AppData or Program Files, or processes named 'kali.exe' or containing 'KaliLinux' in their image or command line, especially when their parent process is 'wsl.exe' or 'wslhost.exe'. The rule filters out common installation or uninstallation commands to reduce false positives.
Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries.
Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path. This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this legitimate Notepad++ installer. The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.
Detects when new credentials (certificates or secrets) are added to an existing application or service principal within Azure/Entra ID. This activity, if not part of expected workflows, could indicate a malicious actor establishing persistence or escalating privileges by adding their own credentials to an application.
Page 196 of 680