SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,515 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects potential persistence behavior using the windows telemetry registry key.
Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections.
This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run.
The problem is, it will run any arbitrary command without restriction of location or type.
Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections.
This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run.
The problem is, it will run any arbitrary command without restriction of location or type.
Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL).
Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.
Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.
Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog.
Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys.
Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.
Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys.
Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.
Detects SMB server connections to shares without signing or encryption enabled.
This could indicate potential lateral movement activity using unsecured SMB shares.
This could indicate potential lateral movement activity using unsecured SMB shares.
Detects the use of short name paths (8.3 format) in command lines, which can be used to obfuscate paths or access restricted locations. Windows creates short 8.3 filenames (like PROGRA~1) for compatibility with MS-DOS-based or 16-bit Windows programs. This technique can be used to bypass security controls, especially in web servers on Windows.
Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory.
It is often used by threat actors for credential dumping and lateral movement within compromised networks.
It is often used by threat actors for credential dumping and lateral movement within compromised networks.
Detects when essential PowerShell DLLs, specifically 'System.Management.Automation.dll', are loaded by processes that are not legitimate PowerShell executables. This behavior can indicate malicious activity, such as an attacker using techniques like meterpreter's 'load powershell' extension or PowerShdll to execute PowerShell commands in a stealthy manner without directly invoking powershell.exe.
Detects Windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse these programs to proxy execution of malicious code, bypassing application control and potentially evading detection. The rule specifically targets `InstallUtil.exe`, `RegAsm.exe`, `RegSvcs.exe`, `regsvr32.exe`, and `rundll32.exe` when they load DLLs that are not signed or have an invalid signature status. It includes filters for common legitimate scenarios to reduce false positives.
Detects when a new rule has been added to the Windows Firewall exception list, specifically looking for uncommon or potentially malicious additions by filtering out common system paths and applications. This rule aims to identify defense evasion attempts where adversaries modify firewall rules to allow their command and control traffic or other malicious network activity.
Detects potential DLL sideloading of 'dbgcore.dll' by identifying instances where this DLL is loaded from non-standard or unexpected file paths. This technique can be used by adversaries for defense evasion, persistence, and privilege escalation.
Page 268 of 680