SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the setting of the "ImagePath" value of a service registry key to a path controlled by a non-administrator user such as "\AppData\" or "\ProgramData\". Attackers often use such directories for staging purposes. This rule might also trigger on badly written software, where if an attacker controls an auto starting service, they might achieve persistence or privilege escalation. Note that while ProgramData is a user controlled folder, software might apply strict ACLs which makes them only accessible to admin users. Remove such folders via filters if you experience a lot of noise.
Detects the S3 Browser utility creating an IAM User or AccessKey in AWS. This activity can be indicative of an attacker establishing persistence or escalating privileges within an AWS environment.
This rule detects when a Conditional Access policy is updated within an Azure environment. It aims to identify unauthorized or suspicious modifications to these critical security policies, which could lead to privilege escalation, credential access, or defense evasion. The rule specifically looks for the message 'Update conditional access policy' in audit logs. Further investigation would involve checking if the actor initiating the change is approved and comparing the old versus new policy values.
This rule detects when guest users are invited to the tenant by individuals who are not on an approved list of inviters. This helps identify unauthorized or suspicious external user invitations that could lead to unauthorized access or compromise.
This rule identifies instances where a user has been assigned a privileged role within Azure Active Directory (now Microsoft Entra ID) but is not actively using that role. This is detected by monitoring 'redundantAssignmentAlertIncident' risk events from the Azure PIM (Privileged Identity Management) service. Such alerts can indicate over-privileged accounts, potential misconfigurations, or accounts that could be targeted for privilege escalation if compromised.
Detects attempts to exploit the sudo vulnerability CVE-2019-14287, which allows a user to run commands as root by specifying a user ID of -1 or 4294967295 (NO_UID_T) with the '-u' option, bypassing the sudoers policy.
This rule detects the use of the PlistBuddy utility to modify LaunchAgents or LaunchDaemons on macOS. Specifically, it looks for command-line arguments that include 'RunAtLoad' and 'true', along with either 'LaunchAgents' or 'LaunchDaemons', indicating an attempt to establish persistence by configuring a program to run automatically at system startup or user login.
Detects network connections to the InterPlanetary File System (IPFS) where the URI contains a pattern indicative of an email address. This behavior is associated with recent phishing campaigns that leverage IPFS to host credential harvesting webpages, attempting to collect user credentials.
This rule detects when a new member is added to a security-enabled global group in a Windows environment. This activity is significant because adding users to such groups can grant them elevated privileges or access to sensitive resources, making it a common action for adversaries attempting privilege escalation or persistence.
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior, often associated with tools like Mimikatz's sekurlsa::pth module. This indicates an adversary is using stolen password hashes to authenticate to a system.
Page 202 of 680