SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,605 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects remote RPC calls made by SharpHound, a BloodHound data collector, to enumerate remote connections and local group memberships. This specific rule targets the MS-SRVS protocol (Server Service Remote Protocol) interface UUID 4b324fc8-1670-01d3-1278-5a47bf6ee188 and operation number 12, which is associated with session enumeration.
This rule detects remote RPC calls to the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) originating from hosts that are not designated as Domain Controllers. Such activity is highly indicative of potential DCSync or DCShadow attacks, where an attacker attempts to replicate Active Directory data, including sensitive credentials, by impersonating a Domain Controller. The rule specifically looks for RPC Firewall logs (EventLog: RPCFW, EventID: 3) where the InterfaceUuid matches 'e3514235-4b06-11d1-ab04-00c04fc2dcd2' (MS-DRSR) and the operation number (OpNum) is not 0, 1, or 12, as these are considered 'dangerous' opcodes when initiated from non-DC hosts.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects attempts to execute remote commands within a Kubernetes Pod's container, typically using the 'kubectl exec' command. This activity is logged as a 'create' verb on the 'pods' resource with the 'exec' subresource in Kubernetes audit logs.
Detects the use of the `syslog` syscall with action codes 4, 5, or 6, which can clear or disable the kernel ring buffer (dmesg logs). This technique can be used by attackers to hide traces after exploitation or privilege escalation. A common method is running `dmesg -c`, which internally triggers this syscall.
Detects attempts by an identity to enumerate its Kubernetes Role-Based Access Control (RBAC) permissions. This activity is often observed in the early stages of a breach as attackers try to understand their access within a compromised Kubernetes environment. This can be achieved by querying the Kubernetes API server's SelfSubjectRulesReview API, for example, using the "kubectl auth can-i --list" command.
Detects attempts to enumerate Kubernetes secrets, which could indicate an adversary is searching for sensitive information like API keys, tokens, or other credentials stored within the cluster.
This rule detects when an Azure Container Registry is either created or deleted. Monitoring these operations can help identify unauthorized infrastructure changes, potential resource manipulation, or attempts to cover tracks by removing evidence. An adversary might create a new container registry to host malicious images or delete an existing one to disrupt services or remove forensic artifacts.
This rule detects suspicious Kerberos Ticket Granting Ticket (TGT) requests, specifically looking for events where a computer account (indicated by a '$' at the end of the `TargetUserName`) requests a TGT with a certificate thumbprint present. This behavior is often observed after an attacker has obtained a computer certificate, potentially through techniques like PetitPotam, and is attempting to leverage it to request Kerberos tickets using tools like Rubeus. The rule focuses on Windows Event ID 4768, which signifies a Kerberos authentication service ticket request. It filters out requests from the local host (::1) and those without a certificate thumbprint.
This rule detects potential DLL sideloading by identifying the loading of specific system DLLs from non-standard, non-system locations. Adversaries often use DLL sideloading to execute malicious code by placing a malicious DLL in a directory where a legitimate application will load it instead of the intended system DLL. The rule includes a comprehensive list of DLLs commonly abused in sideloading attacks and filters out legitimate loads from known system directories to reduce false positives.
Page 312 of 680