SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of programs as Launch Agents or Launch Daemons using the `launchctl` command on macOS. This activity can be indicative of persistence mechanisms established by adversaries.
Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472, also known as Zerologon. This vulnerability allows an unauthenticated attacker to gain domain administrator privileges.
Detects the installation of a PDQDeploy service on a machine. PDQDeploy is a legitimate system management tool that can be leveraged by attackers to remotely install packages or execute commands on target machines, leading to persistence or privilege escalation.
Detects PowerShell writing shortcut (.lnk) files into the Windows startup directory. This technique is commonly used by adversaries to establish persistence, ensuring their malicious code executes each time a user logs in. The rule specifically looks for PowerShell (powershell.exe or pwsh.exe) as the process creating these shortcut files in the 'Start Menu\Programs\Startup' path.
This rule detects when a file is written to the Windows startup directory. This activity is a common technique used by adversaries to establish persistence on a system, ensuring that their malicious code executes automatically when a user logs in or the system boots. The rule specifically looks for file creation events where the target filename contains the path to the 'Start Menu\Programs\StartUp' directory. It includes filters to reduce false positives from legitimate system processes like Windows Update and Microsoft OneNote.
Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.
Detects when an uncommon process modifies the Windows Terminal profile settings file, "settings.json". This activity can be indicative of persistence or privilege escalation attempts where an attacker modifies the terminal's startup behavior or injects malicious commands to be executed when the terminal is launched.
Detects potential DLL sideloading of Python DLL files (python39.dll, python310.dll, python311.dll, python312.dll) by monitoring image load events. The rule filters out legitimate loads from common Python installation paths, Visual Studio, Anaconda, CPython build paths, and PyInstaller bundled applications, as well as legitimately signed Python DLLs, to reduce false positives.
This rule detects the use of PowerShell cmdlets from the 'Microsoft.PowerShell.LocalAccounts' module, which are used to manipulate local user accounts. This includes actions such as disabling, enabling, getting information about, setting properties of, creating, renaming, and removing local users. Adversaries may manipulate accounts to maintain access to victim systems, modify credentials, or change permission groups.
Detects the use of Meterpreter's or Cobalt Strike's 'getsystem' command by identifying specific command-line patterns associated with privilege escalation techniques. The rule looks for processes spawned by 'services.exe' that contain '/c', 'echo', and '\pipe\' (technique 1) or 'rundll32', '.dll,a', and '/p:' (technique 2), which are indicative of these tools attempting to elevate privileges.
Page 213 of 680