SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Monitors for the creation or modification of scheduled tasks in the Windows registry by processes other than common legitimate ones like svchost.exe. This can indicate an adversary establishing persistence or executing malicious code via scheduled tasks.
Detects Server Message Block (SMB) server connections to administrative shares (IPC$, ADMIN$, C$) that are established without signing or encryption enabled. This activity could indicate potential lateral movement by an adversary exploiting insecure SMB configurations.
Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287. The rule looks for specific patterns in the URI query that indicate an attempt to inject commands or save files, which are characteristic of this vulnerability. The presence of '?search=%00{.' combined with keywords like 'powershell', 'cmd.exe', 'cscript', 'wscript', 'python', or paths like 'C:\Users\Public\' suggests an exploitation attempt.
This rule detects the creation of a service named 'WerFaultSvc' with EventID 7045 from the 'Service Control Manager' provider, which is associated with the Turla PNG dropper as reported by NCC Group in November 2018. This indicates potential persistence or privilege escalation by the Turla APT group.
Detects registry persistence used by the OilRig APT group, specifically looking for modifications to the 'SOFTWARE\Microsoft\Windows\CurrentVersion\UMe' or 'SOFTWARE\Microsoft\Windows\CurrentVersion\UT' registry keys. This activity was reported by Nyotron in their March 2018 report.
Detects the deactivation and disabling of the Scheduled defragmentation task using 'schtasks.exe /delete' or 'schtasks.exe /change' commands, specifically targeting the '\Microsoft\Windows\Defrag\ScheduledDefrag' task. This activity has been observed in campaigns by the Slingshot APT group.
Detects the sideloading of specific trojanized DLLs by legitimate Windows executables, a technique observed in Lazarus APT campaigns targeting a Spanish aerospace company. The rule identifies suspicious DLL loads by monitoring 'ImageLoaded' events for particular DLLs being loaded by specific executables from unusual paths, indicating potential DLL hijacking or sideloading for persistence, privilege escalation, or defense evasion.
Detects changes to the "Winlogon" registry key where a process sets the "Shell" value to a string containing specific PowerShell commands observed in KamiKakaBot samples. This technique is used to achieve persistence by executing a malicious script during user logon.
Detects failed sign-in attempts for privileged roles where the user does not meet expected security controls, such as signing in from an unapproved country, IP address, or device. This rule helps identify potential unauthorized access attempts to administrative accounts.
Detects the launch of a child process via "conhost.exe" with the "--headless" flag. This flag is used to hide the console window from the user, which can be leveraged by adversaries for defense evasion to conceal malicious activity.
Page 223 of 680