SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,515 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the removal of a port or application rule in the Windows Firewall configuration using the netsh.exe command-line utility. This activity can be indicative of an adversary attempting to impair defenses to facilitate further malicious activity.
Detects the creation of PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories by processes that are not recognized as legitimate PowerShell executables or installers. This can indicate an attempt to establish persistence or execute malicious code by injecting or creating malicious PowerShell modules.
Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'.
This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap.
These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)
This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap.
These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)
Detects the creation of executable files with names identical to legitimate Windows system processes in directories other than their standard system locations (e.g., System32, SysWOW64). This technique is often used by adversaries for defense evasion and masquerading to blend malicious executables with legitimate system files.
Detects the use of the EnableRegion command in AWS CloudTrail logs.
While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately.
There may be situations where security monitoring does not cover some new AWS regions.
Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment.
While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately.
There may be situations where security monitoring does not cover some new AWS regions.
Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment.
This rule detects when specific Windows executables (csrss.exe, lsass.exe, RuntimeBroker.exe, sihost.exe, smss.exe, wininit.exe, winlogon.exe, dllhost.exe, rundll32.exe, svchost.exe) write files with suspicious extensions such as .bat, .dll, .exe, .hta, .iso, .ps1, .txt, .vbe, and .vbs. This behavior can indicate defense evasion or other malicious activity where legitimate system processes are abused to drop or create malicious files.
Detects potential persistence established through the modification of registry keys related to Visual Studio Tools for Office (VSTO) add-ins for Microsoft Office applications like Outlook, Word, Excel, and PowerPoint. Adversaries can leverage VSTO add-ins to execute malicious code when an Office application starts, thereby maintaining persistence on a compromised system. The rule specifically looks for changes to the 'Addins' registry paths for various Office applications and the VSTO Security Inclusion path, while filtering out common legitimate processes that might make such changes.
Detects the loading of 'Amsi.dll' by specific Living Off the Land Binaries (LOLBINs) such as ExtExport.exe, odbcconf.exe, and rundll32.exe. This activity can indicate an attempt to bypass Antimalware Scan Interface (AMSI) protections, often associated with 'PowerShell without PowerShell' attacks where malicious scripts are executed without directly invoking powershell.exe.
Detects usage of known PowerShell cmdlets such as "Clear-EventLog", "Remove-EventLog", "Limit-EventLog", "Clear-WinEvent", or direct .NET calls to clear Windows event logs. This activity is often performed by adversaries to remove forensic evidence of their actions on a compromised system.
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.
Page 269 of 680