SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects anomalous user activity patterns, specifically focusing on suspicious changes to directories or other behaviors that Microsoft Entra ID Protection identifies as 'anomalousUserActivity'. This could indicate compromised accounts or insider threats.
Detects when a Google Workspace user is granted administrative privileges. This could indicate a legitimate administrative action or a malicious attempt to escalate privileges within the Google Workspace environment.
Detects the start or reload of a service on Linux systems using 'systemctl' or 'service' commands. This can be indicative of persistence mechanisms or privilege escalation attempts where adversaries modify or create services to execute malicious payloads.
Detects attempts to enable the root account on macOS systems using the 'dsenableroot' command-line utility. This action can be used for persistence, privilege escalation, or defense evasion by adversaries.
Detects attempts to create and add an account to the admin group via the `sysadminctl` utility on macOS. This action can be used for persistence, privilege escalation, or defense evasion by creating a new administrative user.
Detects the execution of the hacktool Rubeus using specific command line flags within PowerShell script block logs. This rule identifies various Kerberos-related attacks such as AS-REPRoasting, Kerberoasting, Pass-the-Ticket, Golden Ticket, and Silver Ticket attacks, as well as credential harvesting and dumping.
This rule detects modifications to specific registry keys related to shell open commands for 'ms-settings' and 'exefile'. These modifications are commonly used for persistence and UAC bypass techniques, particularly those leveraging tools like UACMe and targeting executables such as fodhelper.exe, computerdefaults.exe, and slui.exe. The rule looks for changes to 'SymbolicLinkValue', 'DelegateExecute', and '(Default)' values within these registry paths, while filtering out empty default values.
This rule detects attempts to bypass User Account Control (UAC) by modifying the Windows Registry related to the 'mscfile' handler. Specifically, it looks for changes to the default command associated with '.msc' files, which can be abused by 'eventvwr.exe' to execute arbitrary code with elevated privileges without a UAC prompt. The filter excludes legitimate modifications where the 'Details' field starts with '%SystemRoot%\system32\mmc.exe "%1" %', aiming to reduce false positives from standard system operations.
Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware. This indicates that a system is actively being encrypted by this specific ransomware.
This rule detects the use of the CreateRemoteThread API in conjunction with the LoadLibrary function to inject a DLL into another process. Specifically, it looks for events where a remote thread is created, the starting module is 'kernel32.dll', and the starting function is 'LoadLibraryA'. This combination is a common technique for dynamic-link library (DLL) injection, often used by malware to execute arbitrary code within the context of a legitimate process, evade defenses, and potentially elevate privileges.
Page 201 of 680