SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects sign-in failures in Azure Active Directory (now Microsoft Entra ID) that are specifically due to Conditional Access policies not being met. It identifies attempts where a user or service tried to authenticate but was blocked because the Conditional Access requirements were not satisfied. This could indicate an attacker attempting to bypass security controls, or legitimate users/services failing to meet policy requirements.
This rule detects the creation or modification of the `/etc/ld.so.preload` file. This file is used by the dynamic linker (`ld.so`) on Linux systems to specify shared libraries that should be loaded before any other libraries. Adversaries can leverage this mechanism for persistence, privilege escalation, or defense evasion by preloading malicious libraries, effectively hijacking legitimate functions. Refer to `man ld.so` for more details on its functionality.
This rule detects when the Windows Software Restriction Policies (SRP) prevent an application from executing. This can indicate an attempt to run unauthorized software that is blocked by administrative policies, potentially signaling a policy violation, malware execution attempt, or an adversary attempting to bypass security controls. The rule specifically looks for Event IDs 865, 866, 867, and 868 from the 'Microsoft-Windows-SoftwareRestrictionPolicies' provider, which correspond to different reasons for access restriction (default policy, location-based rule, publisher policy, or general policy rule).
Detects a DNS server error indicating that a specified plugin DLL, configured in the registry, could not be loaded. This event can be triggered by an attacker attempting to load a malicious DLL for privilege escalation or persistence on a DNS server, often associated with techniques like DNSAdmin to DC compromise.
Detects when the 'SeEnableDelegationPrivilege' user right is assigned in Active Directory. This privilege allows a user to control other Active Directory user objects, which can be abused for privilege escalation and persistence within a domain.
This rule detects the creation of a new trust relationship to a domain, indicated by Windows Event ID 4706. The addition of domain trusts is an infrequent administrative action and should be carefully verified for legitimacy, as unauthorized trust relationships could be used for privilege escalation or persistence within an Active Directory environment.
This rule detects attempts to tamper with Sysmon's operational settings by monitoring changes to specific registry keys related to Sysmon's event publishers and channels. Specifically, it looks for modifications that disable Sysmon's 'Enabled' status (EventID 4657, NewValue 0) or attempts to delete the Sysmon operational channel (EventID 4663, AccessMask '0x10000'). This activity could indicate a threat actor trying to evade detection by disabling or muting Sysmon logging.
Detects when the Code Integrity (CI) engine blocks a process from loading an unsigned DLL that resides in a suspicious location. This often indicates an attempt to bypass security controls or execute malicious code through DLL hijacking or side-loading.
Detects the creation of a Windows service by the ProcessHacker tool, specifically when the service is configured to run with 'LocalSystem' privileges and its name starts with 'ProcessHacker'. This indicates a potential privilege escalation attempt using ProcessHacker.
Detects potential remote thread creation with specific start addresses often associated with Cobalt Strike beacons, indicating process injection activity.
Page 221 of 680