SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects suspicious access to files with sensitive extensions commonly associated with email archives, database files, memory dumps, and remote desktop connection files. Monitoring access to these file types can indicate attempts at data collection, credential dumping, or lateral movement preparation by adversaries.
This rule detects attempts by non-system accounts to create or write to files on administrative shares (e.g., C$) via Server Message Block (SMB). This activity is often associated with lateral movement or persistence techniques where attackers drop tools or establish footholds on remote systems.
Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) spawning suspicious child processes. This activity is uncommon for baaupdate.exe and could indicate an attempt at lateral movement or defense evasion, potentially via BitLocker DCOM & COM Hijacking, by using baaupdate.exe as a proxy for executing other system utilities.
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
Detects the loading of WSMAN provider DLLs by processes other than the expected svchost.exe, or by svchost.exe with an unexpected original filename. This can indicate local or remote execution using Windows Remote Management (WinRM) or Windows Management Instrumentation (WMI) for lateral movement or execution, potentially by an attacker.
Detects the use of Tor or Tor-Browser to connect to onion routing networks
This rule detects the loading of the 'vssapi.dll' library by executables that are not commonly associated with legitimate Volume Shadow Copy operations. Adversaries often interact with Volume Shadow Copy Service (VSS) DLLs to delete shadow copies, which is a common technique to inhibit system recovery and prevent data restoration after ransomware attacks or data destruction.
Detects when a request has been made to transfer a Route 53 domain to another AWS account.
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Detects the execution of the 'ping.exe' command with a hexadecimal encoded IP address in the command line. This technique is often used by adversaries for defense evasion, specifically to obfuscate network communication or command and control activities, making it harder for security tools to detect the target IP address.
Page 253 of 680