SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,602 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects potential Active Directory enumeration via LDAP
Detects suspicious Kerberos TGT requests with pre-authentication disabled (Pre-Authentication Type = 0) and Ticket Encryption Type (0x17) i.e, RC4-HMAC.
This may indicate an AS-REP Roasting attack, where attackers request AS-REP messages for accounts without pre-authentication and attempt to crack the encrypted ticket offline to recover user passwords.
This may indicate an AS-REP Roasting attack, where attackers request AS-REP messages for accounts without pre-authentication and attempt to crack the encrypted ticket offline to recover user passwords.
Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. Malicious actors often rename legitimate tools like MeshAgent to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely. This could be an indication of malicious software deployment or lateral movement attempts using Windows Installer functionality. The usage of the WindowsInstaller COM object rather than msiexec could be an attempt to bypass detection.
Detects potential execution of MeshAgent, a remote access tool, by looking for the '--meshServiceName' argument in the command line. Threat actors often rename the MeshAgent binary to evade detection, making this command-line argument a more reliable indicator of its use for remote access.
Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled".
Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.
Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.
Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.
Detects the execution of the hdiutil utility in order to create a disk image.
Detects the execution of the BCP utility in order to export data from the database.
Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.
Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.
Detects PowerShell creating a binary executable or a script file.
Page 304 of 680