SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects failed attempts to sign in to disabled accounts within Azure Active Directory. This could indicate an attacker attempting to use compromised credentials for an account that has been deactivated, or an attempt to bypass security controls by targeting dormant accounts.
This rule detects unusual authentication interruptions in Azure Active Directory sign-in logs. Specifically, it looks for three types of ResultType and ResultDescription combinations: '50097 - Device authentication is required', '50155 - DeviceAuthenticationFailed', and '50158 - ExternalSecurityChallenge - External security challenge was not satisfied'. These events indicate that an authentication attempt was interrupted or failed due to device-related issues or an unmet external security challenge, which could be indicative of an adversary attempting to bypass authentication mechanisms or encountering unexpected security controls.
This rule detects successful user authentications from your Azure AD tenant to other Azure AD tenants. This activity can indicate an attacker attempting to maintain access or escalate privileges by leveraging existing user accounts to access resources in external tenants, or it could be a legitimate business-to-business (B2B) collaboration that needs to be approved.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. An investigator can verify connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Detects attempts to change the password of the Directory Services Restore Mode (DSRM) administrator account. This account is a local administrator account on Domain Controllers, and attackers may modify its password to establish persistence or elevate privileges.
Detects suspicious processes attempting to log on with explicit credentials (Event ID 4648). This rule specifically targets common command-line utilities like cmd.exe, powershell.exe, wmic.exe, net.exe, and reg.exe when they are used to explicitly log on, while filtering out localhost connections and service accounts (users ending with '$') to reduce false positives. This behavior can indicate an adversary attempting to escalate privileges or move laterally using compromised credentials.
Detects the creation of a Windows service named 'KrbSCM' which is associated with the KrbRelayUp tool. This tool is used for privilege escalation in Windows domain environments where LDAP signing is not enforced, leveraging Kerberos relay attacks.
Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or it's an unusual program to be run from a Scheduled Task. This rule specifically looks for Event ID 129 (Created Task Process) in the Task Scheduler Operational logs and checks if the executable path contains common temporary or user-download directories.
Detects the loading of the kernel driver associated with the Process Hacker tool. This tool, while legitimate, can be used by adversaries for various malicious activities, including bypassing security controls, inspecting processes, and potentially escalating privileges. The rule identifies the driver by its filename and specific import hashes.
Detects an unexpected file deletion by the dns.exe process. This activity could indicate remote code execution or other forms of exploitation, potentially related to vulnerabilities like CVE-2020-1350 (SigRed), where an attacker might manipulate DNS server files.
Page 218 of 680