SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects DNS queries containing specific base64-encoded patterns ("UWhRCA" and "BAAAA") that are indicative of Kerberos coercion attacks via DNS object spoofing. This technique involves manipulating DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests, forcing victim systems to authenticate to attacker-controlled hosts. This is a strong indicator of a Kerberos coercion attack, potentially related to vulnerabilities like CVE-2025-33073, where a marshaled CREDENTIAL_TARGET_INFORMATION structure is used.
Detects the loading of the System Informer tool's driver, 'SystemInformer.sys', by checking for its file name or specific SHA256 hashes. System Informer is a legitimate system monitoring tool that can be used by adversaries for reconnaissance or to gain deeper system insights, making its driver load a potential indicator of compromise or unauthorized activity.
Detects the load of HackSys Extreme Vulnerable Driver (HEVD.sys), an intentionally vulnerable Windows driver often abused by threat actors for privilege escalation and other malicious activities. The rule identifies the driver by its filename and known IMPHASH values.
This rule detects the creation of files with a '.scr' extension, which are typically Windows screensaver executable files. Adversaries may create or modify these files to establish persistence by executing malicious content when user inactivity triggers the screensaver. The rule includes filters to reduce false positives from known legitimate processes creating screensaver files, such as Kindle.exe, Symantec Endpoint Protection's ccSvcHst.exe, and TiWorker.exe creating uwfservicingscr.scr.
This rule detects the creation of registry keys associated with NetWire RAT. Specifically, it looks for the creation of a registry key containing '\software\NetWire' in its path, which is a known location where NetWire RAT stores its configuration information.
Detects when a user enables DNS-over-HTTPS (DoH) by modifying specific registry keys for Microsoft Edge, Google Chrome, or Mozilla Firefox. Enabling DoH can obscure internet activity, potentially aiding in data exfiltration or evading network monitoring, as it encrypts DNS queries and bypasses traditional DNS visibility.
Detects a suspicious CertReq execution downloading a file.
This behavior is often used by attackers to download additional payloads or configuration files.
Certreq is a built-in Windows utility used to request and retrieve certificates from a certification authority (CA). However, it can be abused by threat actors for malicious purposes.
This behavior is often used by attackers to download additional payloads or configuration files.
Certreq is a built-in Windows utility used to request and retrieve certificates from a certification authority (CA). However, it can be abused by threat actors for malicious purposes.
Detects the creation of the 'shai-hulud-workflow.yml' file, which is associated with the Shai Hulud worm. This worm targets the NPM supply chain and is designed to exfiltrate GitHub secrets. The rule specifically looks for the creation of this file within the '.github/workflows/' directory.
Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write. This rule specifically looks for the execution of 'schtasks.exe' with command-line arguments indicative of modifying an existing scheduled task's properties, such as changing the user account and password, which could be abused in privilege escalation scenarios.
This rule detects the creation of specific registry keys under 'Software\AppDataLow\Software\Microsoft\' that are known to be associated with Ursnif malware. The rule filters out common legitimate registry paths used by Internet Explorer, RepService, IME, and Edge to reduce false positives.
Page 211 of 680