SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,605 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects remote procedure calls (RPC) targeting the MS-SRVS interface (UUID: 4b324fc8-1670-01d3-1278-5a47bf6ee188) which is associated with the Server Service. Abuse of this service can be used for lateral movement within a network, potentially for creating remote shares or other administrative functions. The detection relies on logs from an RPC Firewall.
Identifies when a service account in Azure Kubernetes Service is modified or deleted. This could indicate an adversary attempting to disrupt services, remove access, or manipulate accounts for persistence or privilege escalation within the Kubernetes cluster.
Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled. This rule specifically looks for Event ID 4719, which indicates a change in audit policy, combined with specific Subcategory GUIDs and audit policy change codes ('%%8448' for Success removed or '%%8450' for Failure removed).
This rule detects when 'amsi.dll' is loaded by processes that are not commonly expected to load it. AMSI (Antimalware Scan Interface) is a Windows component that allows applications to integrate with installed antimalware products. Adversaries often attempt to bypass AMSI to execute malicious code without detection. This rule aims to identify such bypass attempts by flagging unusual process-AMSI.dll load combinations. The rule explicitly filters out common legitimate processes and directories that are known to load amsi.dll, such as explorer.exe, Sysmon64.exe, processes in Program Files, System32, SysWOW64, WinSxS, Windows Defender's MsMpEng.exe, and .NET framework related ngentask.exe processes.
Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", "last", "uname", "users", "w", and "who" on Linux systems. Adversaries use these commands to gather information about the system and its users to inform subsequent actions.
Detects remote RPC calls that perform remote DCOM operations, which can be abused for lateral movement via DCOM or WMI. The rule specifically looks for RPC Firewall events with EventID 3 and a set of Interface UUIDs associated with DCOM and WMI activities.
This rule detects the creation of specific files associated with the Octopus Scanner malware. The malware creates files named 'Cache134.dat' and 'ExplorerSync.db' within the user's local AppData\Microsoft directory. This activity is indicative of the malware's presence and operation.
Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse. The rule specifically looks for PowerShell script block text containing commands related to installing the Windows feature, installing the PSWA web application, and adding authorization rules.
This rule detects when known WMI-related modules are loaded by processes that are not typically associated with WMI operations. It specifically looks for the loading of DLLs such as 'fastprox.dll', 'wbemcomn.dll', 'wbemprox.dll', 'wbemsvc.dll', 'WmiApRpl.dll', 'wmiclnt.dll', 'WMINet_Utils.dll', 'wmiprov.dll', and 'wmiutils.dll'. The rule then filters out common legitimate processes that are known to load these WMI modules, including executables located in standard Windows directories (Program Files, System32, SysWOW64), .NET Framework paths, explorer.exe, and specific applications like WindowsAzureGuestAgent, WaAppAgent, Thor, Microsoft Defender's MsMpEng.exe, Microsoft Teams, and Sysmon. The intent is to identify potentially malicious use of WMI by uncommon or unexpected processes, which could indicate execution, persistence, or privilege escalation attempts.
Detects the execution of "aspnet_compiler.exe", a Microsoft .NET Framework utility that can be abused by adversaries to compile and execute C# code. This technique can be used for defense evasion by proxying execution through a trusted developer utility.
Page 315 of 680