SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of a scheduled task using 'schtasks create' in conjunction with 'wscript' and '/e:vbscript', which is a known persistence mechanism used by the ACTINIUM threat group.
This rule detects the loading of specific DLL names known to be used by the SVR-attributed GraphicalProton backdoor. The rule looks for an 'ImageLoaded' event where the DLL name ends with one of the predefined malicious DLL names.
This rule detects specific DLL sideloading activity observed to be used by the Diamond Sleet APT group. It looks for the loading of 'Version.dll' by 'clip.exe' or 'DSROLE.dll' by 'wsmprovhost.exe' when these executables and DLLs are located in the 'ProgramData' directory. This behavior is indicative of an adversary attempting to execute malicious code by tricking legitimate applications into loading their crafted DLLs.
Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406). This behavior is highly indicative of a web shell or similar remote code execution vulnerability being exploited on the CentreStack portal.
Detects a qlogin.exe command attempting to authenticate as the internal `_+_PublicSharingUser_` using a GUID as the password. This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.
This rule detects failed attempts to elevate privileges (PIM activation) in Azure Active Directory from devices that are not designated as Privileged Access Workstations (PAW) or Secure Access Workstations (SAW). It specifically looks for messages indicating 'Add member to role completed (PIM activation)' in the sign-in logs, combined with conditions that identify non-compliant devices, unapproved IP addresses, unapproved countries, or unapproved device information. The rule is designed to flag suspicious privilege elevation attempts that originate from unauthorized or untrusted environments, which could indicate a compromised account or an attempt to bypass security controls.
Detects changes to the AWS Identity Center (formerly AWS SSO) identity provider configuration. Such changes, including associating, disassociating, enabling, or disabling an external identity provider, could be used by an attacker to establish persistent access or escalate privileges through user impersonation.
This rule identifies when an admission controller is executed in Azure Kubernetes. Admission controllers intercept and potentially modify requests to the Kubernetes API server. Adversaries can leverage admission webhooks (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) for persistence, such as injecting malicious containers into pods or intercepting API requests to steal credentials and sensitive information.
This rule detects when a user registers security information, which indicates a change to their authentication method. This could be an attacker adding an authentication method to a compromised account to maintain persistent access.
This rule detects sign-in attempts to Azure Active Directory from devices that are marked as non-compliant. Non-compliant devices typically lack required security configurations, updates, or policies, and their use for authentication can indicate a potential security risk, such as a compromised device or an attempt to bypass security controls.
Page 212 of 680