SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,518 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.
Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys. Specifically, it looks for HTTP/HTTPS links combined with suspicious keywords related to CAPTCHA/verification or common command-line utilities, which are indicative of clipboard hijacking and execution of remotely hosted malicious files or scripts.
Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID). This could be a sign of exploitation of elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
Detects the creation of '.library-ms' files by common archive extraction tools or Windows Explorer, which may indicate an attempt to exploit CVE-2025-24054. This vulnerability can lead to automatic outbound SMB or WebDAV authentication requests, potentially exposing NTLMv2-SSP hashes to an attacker without user interaction beyond archive extraction on unpatched systems.
This rule detects the execution of Visual Studio Code's tunnel feature. Attackers can abuse this functionality to establish a command and control (C2) channel, allowing them to remotely control a compromised system. The rule looks for specific command-line arguments associated with the tunnel feature, including '.exe tunnel' and '--accept-server-license-terms'. It also identifies scenarios where 'cmd.exe' is used as a parent process to launch the tunnel, specifically looking for 'code-server.cmd' within the command line.
Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.
Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.
Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious.
Detect the creation of a service with a service binary located in a suspicious directory
Detects file access requests to browser credential stores by uncommon processes. This could indicate a potential attempt at credential stealing. This rule requires heavy baselining before usage to reduce false positives.
Page 277 of 680