SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,474 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.
Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.
Detects the creation of an administrator account on a Fortinet FortiGate Firewall.
Detects a highly relevant Antivirus alert that reports a remote access tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders.
Both services are used in the tool Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU (https://github.com/hfiref0x/KDU)
Both services are used in the tool Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU (https://github.com/hfiref0x/KDU)
Detects known suspicious (default) user-agents related to scanning/recon tools
Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.
Detects the modification of a user group on a Fortinet FortiGate Firewall.
The group could be used to grant VPN access to a network.
The group could be used to grant VPN access to a network.
Detects the modification of VPN SSL Settings (for example, the modification of authentication rules).
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
Detects the attempt to install new skills for AI agents using the "npx skills" command.
Agent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user.
The "npx skills" command can install skills for various agents (e.g., Claude Code, Cursor, and others).
Analysts should review any installed skills to verify their legitimacy.
Note: Tune this rule based on whether AI agent tooling is allowed in your environment.
In environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly.
In environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation.
Agent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user.
The "npx skills" command can install skills for various agents (e.g., Claude Code, Cursor, and others).
Analysts should review any installed skills to verify their legitimacy.
Note: Tune this rule based on whether AI agent tooling is allowed in your environment.
In environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly.
In environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation.
Page 24 of 680