SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,608 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects attempts by uncommon applications to access Windows Data Protection API (DPAPI) Master Keys. Such access can indicate credential theft, for example, through tools like Mimikatz's "dpapi::masterkey" function. The rule specifically looks for file access requests to the DPAPI master key directories for both system and user accounts, while filtering out access from common system and program files locations to reduce false positives.
This rule detects the execution of the Node.js executable that is bundled with Adobe Creative Cloud, specifically when it is used to execute scripts outside of the legitimate 'Adobe Creative Cloud Experience\js' directory. This behavior can indicate an adversary attempting to leverage a trusted application's bundled interpreter for malicious script execution, potentially bypassing application control or whitelisting solutions.
This rule detects the execution of 'esentutl' with the '/p' parameter. This command-line utility is used for database utilities, and its use with '/p' (repair mode) can be leveraged by adversaries to access or repair Extensible Storage Engine (ESE) databases, including the NTDS.dit file which contains Active Directory credential information. This technique has been observed in use by threat actors like Conti ransomware and Trickbot to gather credentials or other sensitive information from compromised systems.
Detects rundll32 execution where the DLL is located on a remote network share (UNC path). This technique is often used by adversaries for defense evasion, execution, and lateral movement by leveraging a legitimate Windows utility to load and execute malicious code from a remote location.
Detects the execution of PsExec, a legitimate but often abused tool for remote command execution. The rule specifically looks for the executable name 'psexec.exe' or its original filename 'psexec.c' in process creation events.
This rule detects remote RPC calls made to query information about scheduled tasks. Specifically, it monitors for RPC Firewall events (EventID 3) with a specific InterfaceUuid (86d35949-83c9-4044-b424-db363231fd0c) which corresponds to the ITaskSchedulerService. The rule filters out common operational numbers (OpNum 1, 3, 4, 10, 11, 12, 13, 14, 15) to reduce false positives, focusing on less common or potentially malicious reconnaissance activities related to scheduled tasks.
Detects suspicious log entries in Linux log files
Detects when a Kubernetes RoleBinding or ClusterRoleBinding is created, modified, or deleted. This activity can indicate privilege escalation attempts or unauthorized access within a Kubernetes cluster.
Detects the registration of a new ODBC driver where the driver's DLL is located in a potentially suspicious or non-standard system directory. Adversaries may use this technique to establish persistence or facilitate credential access by registering malicious ODBC drivers.
Detects potentially suspicious child processes spawned by Wscript.exe or Cscript.exe. This includes scenarios where these script hosts launch command-line interpreters (cmd.exe, powershell.exe) that then execute tools like rundll32, regsvr32, msiexec, or mshta with network-related arguments. It also covers direct spawning of rundll32.exe by Wscript/Cscript, while filtering out common legitimate uses of rundll32. This behavior is often observed in malware such as Pikabot and Qakbot for execution and defense evasion.
Page 320 of 680