SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,608 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share by applications that are not commonly expected to access these files. This can indicate an attempt to gather credentials or configuration details from Group Policy Objects.
Detects the creation of specific files within the ProgramData directory that have been observed in campaigns by the Forest Blizzard APT group (also known as Star Blizzard, SEABORGIUM, Callisto Group, TA446, COLDRIVER). These files include those with names like 'prnms003.inf_', 'prnms009.inf_', '.save', 'doit.bat', 'execute.bat', 'servtask.bat', and '.dll' files containing 'wayzgoose', often found in subdirectories under common vendor names within ProgramData.
Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of USB flash drives, SD cards, External hard disk drives, and other drives formatted with NTFS, FAT16, FAT32, or exFAT file systems. This is a rarely used application, and its usage is worth investigating. Malware such as Lumma Stealer has been observed using this process as a target for process hollowing.
This rule monitors for attempts to write potentially malicious files into the C:\Windows\Fonts\ directory using command-line utilities. This folder is often targeted by adversaries because it typically does not require administrative privileges for writing and execution, making it a suitable location for defense evasion and persistence. The rule specifically looks for common command-line tools (like 'echo', 'copy', 'type', 'file createnew', 'cacls') combined with the target path 'C:\Windows\Fonts\' and various executable or script file extensions.
This rule detects attempts to interact with Sysmon processes (Sysmon.exe or Sysmon64.exe) with specific access rights (0x1400), which is indicative of the SysmonEnte tool. It also directly looks for the string 'Ente' in the CallTrace, which is a unique identifier for SysmonEnte's activity. The rule filters out legitimate access from common program file locations and Microsoft Defender to reduce false positives.
This rule detects attempts by uncommon processes to access sensitive files associated with Chromium-based browsers. These files typically contain user data such as cookies, browsing history, and web data, which could be leveraged for credential access or other malicious activities if exfiltrated. The rule specifically targets file paths related to Chromium's user profile data and filters out access by common system processes and known legitimate applications like Windows Defender to reduce false positives.
Detects the execution of the Ammyy Admin RMM agent for remote management, specifically when rundll32.exe is used to load and execute the aa_nts.dll component.
Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.
Detects file access requests to browser credential stores by uncommon processes. This could indicate a potential attempt at credential stealing. This rule requires heavy baselining before usage.
Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is trying to print/save a registry key as a PDF in order to potentially extract sensitive information and bypass defenses.
Page 324 of 680