SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,608 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive activity aiming to impact business operations.
This rule detects the creation of files with specific naming conventions and extensions that are indicative of exported or stolen DPAPI backup keys and certificates. These patterns are commonly associated with tools like Mimikatz and DSInternals, which adversaries use to extract credentials and cryptographic material from Windows systems. The rule looks for filenames containing "ntds_capi_", "ntds_legacy_", or "ntds_unknown_" and ending with ".cer", ".key", ".pfx", or ".pvk".
This rule detects the creation of remote PowerShell sessions by monitoring for the 'wsmprovhost.exe' process. It triggers when 'wsmprovhost.exe' appears as either the main process image or as a parent process, indicating an active PowerShell remote session, typically facilitated by Windows Remote Management (WinRM).
Detects remote RPC calls to read information about scheduled tasks via AtScv. This activity can indicate an adversary performing reconnaissance to understand the environment and identify potential lateral movement opportunities.
Detects when an Azure Kubernetes Cluster is created or deleted. This activity can indicate significant infrastructure changes, either legitimate or malicious. Monitoring these operations is crucial for maintaining the security and integrity of containerized environments.
This rule detects attempts to create or rename files with a space at the end of their filename, which can be used to obfuscate malicious files or commands. Specifically, it looks for command-line executions involving 'echo "*" > * && chmod +x *' or 'mv * "* "'. The first pattern suggests creating an executable file with a trailing space, and the second suggests renaming a file to include a trailing space.
This rule detects the installation of Microsoft Installer (MSI) packages directly from a web source. It specifically looks for MsiInstaller events (EventID 1040 or 1042) in the Windows Application event log where the installation data contains a web protocol indicator (e.g., '://'). This behavior can be indicative of an attacker using msiexec.exe to download and execute malicious MSI files from a remote server, potentially bypassing traditional security controls.
Detects uncommon network connections to the Active Directory Web Services (ADWS) on port 9389 from processes not typically associated with ADWS management. This can indicate an adversary performing discovery of Active Directory information.
Detects the execution of mstsc.exe (Microsoft Terminal Services Client) when its parent process is an uncommon application, specifically web browsers or email clients. This behavior can indicate an adversary attempting to establish an RDP connection after downloading or receiving a malicious .rdp file, potentially as part of an initial access or lateral movement attempt.
Detects suspicious processes based on name and location that access the Windows Credential Manager and Vault. This activity can be indicative of credential stealing, such as that performed by Mimikatz's "dpapi::cred" function.
Page 319 of 680