SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects failed attempts by a user or process to call the 'LsaRegisterLogonProcess' function. This function requires the 'SeTcbPrivilege' privilege, which is typically held by legitimate logon processes. A failure to call this function, especially when combined with the '0x8010000000000000' keyword indicating a failure, could suggest an attacker (e.g., using tools like Rubeus) is attempting to interact with the Local Security Authority (LSA) to gain unauthorized access to credentials or perform other malicious activities. The rule specifically looks for Event ID 4673 (A privileged service was called) where the service is 'LsaRegisterLogonProcess()' and the operation failed.
Detects when a user account is added to the local 'Administrators' group on a Windows system. This activity is critical for privilege escalation and persistence, as it grants the added user administrative rights. While it can be a legitimate administrative action, it is also a common technique used by attackers to maintain control and elevate privileges after initial compromise.
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
Detects the creation of a new Windows service where the creating process has a Process ID (PID) of 0 or its parent process has a PID of 0. This is an unusual and suspicious behavior, as PID 0 is typically reserved for the System Idle Process or the System process itself, which should not be directly creating services. This could indicate a highly privileged process or kernel-level activity attempting to establish persistence or escalate privileges.
Detects remote thread creation initiated by specific scripting engines or Microsoft Office applications (cscript.exe, wscript.exe, mshta.exe, winword.exe, excel.exe) into processes within the SysWOW64 directory, where the start module is null. This behavior is characteristic of the CACTUSTORCH hack tool, which injects shellcode into legitimate processes to evade detection.
This rule detects the creation of an executable named 'Get-Variable.exe' within the 'Local\Microsoft\WindowsApps\' directory. This is a suspicious activity because 'Get-Variable' is a legitimate PowerShell cmdlet, not an executable. Adversaries can exploit the Windows application execution alias feature, where executables in the WindowsApps directory can be prioritized over PowerShell cmdlets with the same name. By placing a malicious 'Get-Variable.exe' in this path, an attacker can trick the system into executing their malicious binary instead of the intended PowerShell cmdlet when 'Get-Variable' is invoked, leading to persistence or privilege escalation.
This rule detects PowerShell scripts attempting to identify a virtualization or sandbox environment. It specifically looks for the use of WMI objects like 'MSAcpi_ThermalZoneTemperature' and 'Win32_ComputerSystem' in PowerShell script block text, which are commonly queried by malware to determine if it's running in a virtualized environment.
Detects command line parameters used by ADCSPwn, a tool designed to escalate privileges in an Active Directory network. This tool achieves privilege escalation by coercing authentication from machine accounts and relaying it to the certificate service.
Detects the presence of a base64-encoded signature ("UWhRC....AAYBAAAA") in the command line, which corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. This pattern is a strong indicator of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests, potentially exploiting vulnerabilities like CVE-2025-33073. The rule aims to identify attempts to add spoofed SPNs to DNS records or check for their presence using commands like `nslookup`.
Detects when an attacker attempts to modify an existing scheduled task to execute a payload from suspicious locations. This technique allows attackers to bypass detection mechanisms that primarily focus on the creation of new scheduled tasks, by instead altering a legitimate task to include their malicious code.
Page 208 of 680