SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the removal or modification of system firewall rules using common Linux firewall management tools like iptables, firewall-cmd, ufw, and nft. This rule specifically looks for commands that delete or remove existing rules, which adversaries might use to bypass network controls and enable C2 communications, lateral movement, or data exfiltration. This detection aims to catch more granular firewall modifications than just a complete firewall disablement.
Detects (failed) outbound connection attempts to internet-facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397, which is a critical elevation of privilege vulnerability in Microsoft Outlook. The vulnerability allows an attacker to send a specially crafted email that, when opened, causes the victim's system to connect to an attacker-controlled SMB share and leak the victim's NTLM hash. This rule specifically looks for SMB client connectivity events (Event IDs 30803, 30804, 30806) where the destination IP address is not a private or loopback address, indicating an attempt to connect to an external SMB server.
This rule detects the use of various web request commands and cmdlets within PowerShell script block logs. It specifically looks for common methods used to initiate web requests or file transfers, such as `[System.Net.WebRequest]::create`, `curl`, `Invoke-RestMethod`, `Invoke-WebRequest`, `irm`, `iwr`, `Resume-BitsTransfer`, `Start-BitsTransfer`, `wget`, and `WinHttp.WinHttpRequest`. The rule aims to identify suspicious activity where PowerShell is used to download or interact with remote resources, potentially for ingress tool transfer or command and control. A filter is applied to exclude paths starting with 'C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\', which are likely legitimate system activities.
Detects the use of Windows 8.3 short filenames (e.g., `PROGRA~1`) in process image paths. This technique can be used by adversaries to evade detection mechanisms that rely on full file paths, as the short name might bypass certain allow-listing or block-listing rules.
This rule detects activity associated with the WannaCry ransomware. It specifically looks for the creation of processes with image names commonly used by WannaCry variants (e.g., 'tasksche.exe', 'mssecsvc.exe', 'WanaDecryptor' in the image path) or command lines containing the WannaCry ransom note filename ('@Please_Read_Me@.txt').
Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location. This can indicate an attempt by an adversary to masquerade malicious executables as legitimate system processes to evade detection.
This rule detects the addition of an AppX package to the "to be processed" pipeline when the package is located in an uncommon directory. AppX packages are a Windows application packaging format. Adversaries may leverage this mechanism to deploy malicious applications or achieve persistence. The rule specifically filters out common and legitimate installation paths and sources, such as Program Files, WindowsApps, SystemApps, and Microsoft-related CDN URLs, to reduce false positives. Detection is based on Event ID 854 from the AppXDeployment-Server log source.
Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious, publicly writable locations. This activity could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking, abusing the BDEUILauncher Class to execute code in the logged-on user's session without credential theft.
This rule detects the creation of remote threads by a specific list of uncommon processes. These processes are often legitimate Windows executables or common applications that are not typically expected to create remote threads in other processes. Such activity can be indicative of process injection techniques used by adversaries for defense evasion or privilege escalation. The rule includes filters to reduce false positives from known legitimate remote thread creations by some of these processes.
Detects the creation of files with executable or script extensions by Microsoft Office applications. This behavior can indicate an attempt to drop and execute malicious code, often associated with initial access or execution phases of an attack. The rule specifically looks for common Office applications creating files with extensions like .exe, .dll, .ps1, .vbs, etc., while filtering out known legitimate activities.
Page 252 of 680