SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation or modification of scheduled tasks via Group Policy Objects (GPO), which can be used by adversaries for persistence, execution, and lateral movement, often seen in ransomware deployment scenarios. The rule specifically looks for Event ID 5136 (Directory Service Changes) indicating modifications to GPO attributes related to machine or user extension names, and Event ID 5145 (Detailed File Share) indicating write access to ScheduledTasks.xml within the SYSVOL share.
Detects modifications to Group Policy Object (GPO) attributes, specifically 'gPCMachineExtensionNames', that are indicative of adding privileges to user accounts or adding users as local administrators. This is identified by the presence of specific GUIDs ('827D319E-6EAC-11D2-A4EA-00C04F79F83A' or '803E14A0-B4FB-11D0-A0D0-00A0C90F574B') within the 'AttributeValue' field of EventID 5136. These GUIDs are associated with Group Policy extensions that can be abused for privilege escalation.
Detects unusual processes accessing `desktop.ini` files. Adversaries can leverage `desktop.ini` to alter how Windows Explorer displays a folder's content (e.g., renaming files or changing icons) without modifying the actual files on disk. This can be used for persistence, privilege escalation, or to hide malicious files.
Detects the execution of the hacktool Rubeus via PE information or command line parameters. Rubeus is a C# toolset designed for raw Kerberos interaction, often used for credential access, Kerberoasting, and pass-the-ticket attacks.
Detects specific process creation patterns associated with the Winnti malware campaign targeting Hong Kong universities in late 2019 and early 2020. The rule looks for suspicious parent-child process relationships and specific file paths used by the malware, such as executables under 'C:\Windows\Temp', 'C:\ProgramData\DRM', and 'C:\ProgramData\DRM\CLR'. It also identifies instances where legitimate applications like 'wmplayer.exe' or 'SearchFilterHost.exe' are launched from these suspicious directories or by suspicious parent processes.
Detects various suspicious activities associated with the HAFNIUM threat group targeting Microsoft Exchange servers. This includes attempts to hide files using `attrib`, scheduled task creation for persistence, execution of an unusual Opera browser, shadow copy enumeration, and data staging/exfiltration using `makecab`, `7zip`, and `rundll32` for minidump creation.
This rule identifies the suspicious use of the AWS Security Token Service (STS) API call `GetSessionToken`. This API call is used to request temporary, limited-privilege credentials for an IAM user or role. Attackers may use `GetSessionToken` to generate temporary tokens to move laterally within an AWS environment or escalate privileges by assuming roles with broader permissions. The rule specifically looks for `GetSessionToken` calls made by an `IAMUser`.
Detects when a user account is created and subsequently deleted within a short period. This behavior can indicate an adversary attempting to establish temporary persistence, perform actions, and then remove traces of their activity to evade detection. It could also be related to privilege escalation attempts where an account is created for a specific task and then removed.
Detects the addition of a new root certificate authority to an Azure AD tenant. This action can be performed by an attacker to establish persistence and enable certificate-based authentication for unauthorized access, potentially bypassing traditional password-based authentication mechanisms. This is a critical security event as it can lead to privilege escalation and persistent access within the Azure AD environment.
Detects when users successfully authenticate to Azure AD using only single-factor authentication, indicating that MFA was not required or was bypassed. This could be due to misconfiguration, an attacker bypassing MFA, or legitimate exceptions.
Page 203 of 680