SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,517 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects attempts to change the PowerShell script execution policy to a less secure level (Bypass or Unrestricted) using the '-ExecutionPolicy' flag. This can be abused by adversaries to execute unsigned or malicious scripts.
Detects the creation of a new kernel driver service using 'sc.exe'. This activity can be indicative of persistence or privilege escalation attempts by adversaries, as kernel drivers operate with high privileges. The rule specifically looks for 'sc.exe' commands that include 'create' or 'config' along with 'binPath', 'type', and 'kernel' parameters. It includes filters for known legitimate Avira driver installations to reduce false positives.
Detects the creation of suspicious child processes, such as common scripting or living-off-the-land binaries (LOLBINs), originating from applications located within the WindowsApps directory. This activity could indicate the execution of malicious '.appx' packages or other forms of code execution from an unexpected and potentially untrusted source.
Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc., and connects to a web application over http(s). This could indicate a possible phishing attempt, where a malicious document is used to redirect a user to a malicious website.
Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection, which is a defense evasion technique.
Detects the use of the 'dir' command with the '/S' flag, which enumerates files and subdirectories. This can be used by adversaries for discovery purposes to understand the file system structure and locate interesting files.
Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers.
This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.
This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.
Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep.
Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted.
This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.
Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted.
This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.
Detects the deletion of Internet Information Services (IIS) WebServer access logs, which could indicate an adversary attempting to remove forensic evidence of their activities on a compromised web server. The rule specifically looks for delete events targeting files within the common IIS log directory structure (`\inetpub\logs\LogFiles\`) with a `.log` extension.
Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs
Page 272 of 680