SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,518 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects errors when a target server doesn't have suitable keys for generating Kerberos tickets. This issue can occur, for example, when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled. This can indicate a misconfiguration or an attempt by an attacker to exploit weak encryption types.
Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID)
This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping.
Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping.
Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
Detects attempts to access the PowerShell console history file (ConsoleHost_history.txt) or retrieve its path. This activity can indicate an adversary attempting to gather plaintext credentials or perform reconnaissance on previously executed commands.
Detects the installation and configuration of a TacticalRMM agent where specific command-line flags (--api, --auth, --client-id, --site-id, --agent-type) are used. This indicates the agent is being configured to connect to a particular RMM server with authentication and client/site identification. This activity could signify a threat actor attempting to register the agent with their own controlled RMM infrastructure for persistent remote access.
Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious.
Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development.
Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems.
Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation.
Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development.
Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems.
Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation.
Detects the execution of Regsvr32.exe with DLL files that have been renamed or masqueraded with suspicious file extensions. This technique is often used by adversaries for defense evasion and to bypass application control by proxying execution through a legitimate Windows binary.
Detects the creation of a new service using the "sc.exe" utility. This activity can be used by adversaries for persistence or privilege escalation by creating a malicious service that executes at system startup or with elevated privileges.
Detects potentially suspicious inline JavaScript execution using Node.js with specific keywords in the command line.
Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.
Detects the use of PowerShell modules and cmdlets to gather local group information.
Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
Page 280 of 680