SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,547 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects port forwarding activity via SSH.exe
Detects the dual-use tool ADExplorer writing a complete Active Directory snapshot into a .dat file. This activity can be leveraged by attackers for various purposes, including data extraction for tools like Bloodhound, gathering usernames for password spraying attacks, or utilizing metadata for social engineering. While the snapshot typically does not contain password hashes, there have been instances where administrators inadvertently stored passwords in comment fields within Active Directory, which could then be exposed through such snapshots.
This rule detects attempts to disable Multi-Factor Authentication (MFA) within Microsoft 365 services. Specifically, it looks for audit log entries containing the operation 'Disable Strong Authentication.' This action could be performed by an attacker to maintain persistent access to compromised accounts by removing an important security layer.
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag to save a local copy of the Active Directory database. This activity is suspicious as it can be used by attackers to extract data for Bloodhound, gather usernames for password spraying, or obtain metadata for social engineering. While the snapshot typically doesn't contain password hashes, administrators sometimes store passwords in comment fields, which could be exposed.
This rule detects potential enumeration of AWS S3 buckets by looking for the 'ListBuckets' API call in AWS CloudTrail logs. It specifically filters out activities performed by 'AssumedRole' identities to reduce false positives from legitimate automated processes or services.
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag to create a local copy of the Active Directory database. This activity can be used by attackers for various purposes, including extracting data for Bloodhound, gathering usernames for password spraying, or leveraging metadata for social engineering. While the snapshot does not contain password hashes, administrators sometimes store passwords in comment fields, which could be exposed.
Detects the addition of a new Federated Domain within Microsoft 365 audit logs. This activity can be a legitimate administrative action but also indicates potential federated credential abuse or the establishment of a backdoor via federated identities.
This rule detects suspicious inbox forwarding rules, specifically those that forward a copy of all emails to an external address. This behavior is often indicative of an attacker attempting to exfiltrate sensitive information from a compromised mailbox.
Detects suspicious service installation scripts
One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe
Page 289 of 680