SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,603 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the presence and execution of the Inveigh hack tool by monitoring for the creation of its characteristic log and executable files. Inveigh is a PowerShell-based tool used for network sniffing, LLMNR/NBNS/mDNS spoofing, and NTLM relay attacks.
Detects the execution of the Microsoft Quick Assist tool, 'QuickAssist.exe'. This utility can be leveraged by attackers to gain remote access to a system, often in social engineering attacks leading to further compromise like ransomware.
This rule detects the installation of the TacticalRMM agent service on a Windows system. It specifically looks for Event ID 7045 from the 'Service Control Manager' provider, indicating a service installation, and then checks if the 'ImagePath' contains 'tacticalrmm.exe' or the 'ServiceName' contains 'TacticalRMM Agent Service'. TacticalRMM is a legitimate remote monitoring and management (RMM) tool, but it can be abused by adversaries for remote access and control.
Detects DNS queries to legitimate TeamViewer domains originating from an application that is not identified as TeamViewer. This behavior can indicate an adversary attempting to obfuscate their use of remote access software by renaming the executable or using a different process to initiate the connection.
Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research, it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll, which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API.
This rule detects the creation of temporary installation artifacts for GoToAssist Remote Support Expert in the user's AppData\Local\Temp directory. Adversaries often use legitimate remote access tools like GoToAssist to establish command and control, and the presence of these temporary files can indicate such activity.
Detects the creation of temporary files (sam.tmp, sec.tmp, sys.tmp) in the Windows temporary directory, which are indicators of the RemoteKrbRelay SMB Relay attack module attempting to dump secrets from the Security Account Manager (SAM) and other system hives.
This rule detects the creation of 'TeamViewer_Desktop.exe' on a Windows system. This file is typically created during the installation of TeamViewer, a legitimate remote access tool. Adversaries often abuse such tools for command and control, making its installation a potential indicator of compromise.
This rule detects the creation or modification of files containing the string '\Bin\ScreenConnect.' in their target filename. This pattern is indicative of temporary installation artifacts for ScreenConnect, a legitimate remote access tool that can be abused by adversaries for command and control or remote access. The rule aims to identify the presence of these artifacts, which could signal the installation or use of ScreenConnect on a system.
This rule detects the execution of 'tscon.exe' with SYSTEM privileges. 'tscon.exe' is a legitimate Windows utility used to connect to or disconnect from a session on a Remote Desktop Session Host server. When executed as SYSTEM, it can be used by an attacker to hijack an active RDP session without requiring credentials or user interaction, leading to privilege escalation and lateral movement. This technique is often referred to as RDP session hijacking.
Page 308 of 680