SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when certificate-based authentication has been enabled in an Azure Active Directory tenant. This change can be an indicator of an adversary establishing a new authentication method for persistence or privilege escalation, or preparing for such activities.
This rule detects the creation of new systemd service unit files in standard systemd directories. Adversaries often create or modify systemd services to establish persistence or escalate privileges by executing malicious code at system startup or when specific events occur. The rule specifically looks for file creation events in '/usr/lib/systemd/system/', '/etc/systemd/system/', and user-specific '/.config/systemd/user/' directories, which are common locations for systemd unit files.
Detects the execution of the 'doas' utility on Linux systems. 'doas' allows standard users to execute commands as another user, typically root, similar to 'sudo'. This can be used by adversaries for privilege escalation or defense evasion.
Detects attempts to add a user account to the 'admin' group on macOS using the `dseditgroup` utility, which grants administrative privileges to the added user. This action can be used for persistence, privilege escalation, or defense evasion by an attacker.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. This rule specifically looks for the `TeamViewer_Desktop` process being launched by `TeamViewer_Service` with specific command-line arguments, indicating a remote connection. An investigator can verify connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
This rule detects modifications to Cisco device configurations that could be used by an adversary for persistence, privilege escalation, or to impact system availability. Specifically, it looks for commands related to enabling HTTP/HTTPS servers, configuring Kron jobs (scheduled tasks), modifying access lists, archiving configurations, and setting NTP servers. These commands, if used maliciously, can allow an attacker to maintain access, execute arbitrary commands, control network access, or disrupt time synchronization.
This rule detects specific DCE-RPC function calls that are indicative of persistence techniques on a remote Windows system. The detected operations include adding print monitors or print processors, and creating processes with logon credentials, which can be abused by adversaries to maintain access or execute code.
This rule detects the use of the hacktool Ruler by Sensepost, specifically looking for 'RULER' in the Workstation or WorkstationName fields of Windows Security Event IDs 4776 (Credential Validation) and 4624/4625 (Logon/Logoff). Ruler is a tool designed to abuse Microsoft Exchange services.
This rule detects attempts to downgrade NetNTLM security settings by monitoring modifications to specific registry keys related to LSA (Local Security Authority) configuration. Specifically, it looks for changes to 'LmCompatibilityLevel', 'NtlmMinClientSec', and 'RestrictSendingNTLMTraffic' within the 'SYSTEM\ControlSet\Control\Lsa' registry path. Such modifications can weaken NTLM authentication security, potentially enabling downgrade attacks where an attacker forces a less secure authentication protocol.
Detects non-system users performing privileged operations on the Service Control Manager (SCM) database, specifically taking ownership of the 'servicesactive' object. This could indicate an attempt to manipulate Windows services for privilege escalation or persistence.
Page 207 of 680