SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,474 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application.
This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function
This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function
Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.).
It is highly recommended to perform an initial baseline before using this rule in production.
It is highly recommended to perform an initial baseline before using this rule in production.
Detects suspicious processes based on name and location that access the windows credential manager and vault.
Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function
Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function
Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Detects rundll32 execution where the DLL is located on a remote location (share)
Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages
Detects certain command line parameters often used during reconnaissance activity via web shells
Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).
Detects enumeration of local system accounts on MacOS systems.
This can be used by attackers to identify accounts for lateral movement or privilege escalation.
This can be used by attackers to identify accounts for lateral movement or privilege escalation.
Detects the usage of SystemSettingsAdminFlows.exe to disable Windows Defender.
SystemSettingsAdminFlows.exe is a legitimate Windows component used for administrative configuration tasks.
However, attackers may abuse it to disable Windows Defender as part of their attack chain, especially in the context of ransomware or other malware campaigns.
SystemSettingsAdminFlows.exe is a legitimate Windows component used for administrative configuration tasks.
However, attackers may abuse it to disable Windows Defender as part of their attack chain, especially in the context of ransomware or other malware campaigns.
Page 23 of 680