SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of the 'EnableRegion' command in AWS CloudTrail logs. This command allows an AWS account to enable additional regions. Monitoring this activity is crucial because adversaries might enable new, less-monitored regions to establish persistence, exfiltrate data, or conduct other malicious activities, potentially bypassing existing security controls that are not configured for these new regions.
Detects global permissions change activity.
Detects when a new member is added or invited to a github organization.
Detects access to Okta admin functions through proxy.
Detects when an user assumed another user account.
Detects when an user account is locked or suspended.
This rule detects the installation of a Windows service named 'NtsSrv' with an ImagePath ending in ' LocalService'. This specific service name and image path pattern are associated with the StoneDrill wiper malware, as described in Kaspersky's research.
Detects the deactivation or disabling of the Windows Scheduled Defragmentation task, which has been observed as a tactic used by the Slingshot APT group to hinder forensic analysis or system maintenance.
Detects activity associated with the APT31 (ZIRCONIUM) threat group, specifically focusing on credential dumping using ldifde, lateral movement attempts involving copying tools like procdump64.exe, netsess.exe, and 7za.exe to remote shares, and archiving data. This rule is based on observations described in the Crowdstrike 2019 Global Threat Report.
Detects suspicious VBScript execution patterns, specifically looking for a combination of keywords often used by UNC2452 (NOBELIUM) in their malware. The rule identifies command lines containing 'Execute', 'CreateObject', 'RegRead', 'window.close', and '\Microsoft\Windows\CurrentVersion', while filtering out common legitimate uses involving the 'Run' registry key path to reduce false positives.
Page 209 of 680