SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,547 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the addition of a new network route to a route table in AWS. This activity can be indicative of an adversary attempting to reroute traffic for C2, exfiltration, or to bypass network controls.
Detects modifications to file or folder permissions using common Windows command-line utilities such as cacls, icacls, net, attrib, and takeown. This can indicate an adversary attempting to evade access controls or gain access to protected files.
Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. Devtunnels can be used for command and control or data exfiltration by tunneling traffic over legitimate-looking DNS requests.
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
This rule detects when AWS Config service components, specifically delivery channels or configuration recorders, are disabled. Adversaries may disable these services to impair an organization's ability to monitor and audit changes within their AWS environment, thereby hindering detection of malicious activities.
This rule detects critical changes to AWS CloudTrail configurations, specifically when a CloudTrail is stopped (StopLogging), updated (UpdateTrail), or deleted (DeleteTrail). These actions can indicate an attempt by an attacker to evade detection by disabling or modifying logging capabilities to obscure their activities within the AWS environment.
This rule detects the creation of new network Access Control List (ACL) entries within an AWS route table. Such an event could indicate that new network access vectors have been opened, potentially allowing unauthorized access or facilitating malicious activities within the AWS environment. This is a critical security event as it directly impacts network segmentation and access control.
Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse this feature to establish a reverse shell or persistence on a machine.
Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide a user account from being listed on the logon screen. This is a defense evasion technique used by adversaries to maintain stealth.
Detects the usage of "reg.exe" to tamper with various Windows Defender registry keys. This tampering aims to disable important features related to protection and detection, such as real-time monitoring, cloud protection, tamper protection, and other security functionalities. The rule specifically looks for `reg.exe` commands adding or modifying DWORD values to '0' or '1' for known Windows Defender settings.
Page 291 of 680