SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,608 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects attempts to access the "unattend.xml" file, which can contain sensitive credentials used during the unattended Windows installation process. Attackers may target this file to harvest credentials.
Detects Microsoft Word loading an Add-In (.wll) file, which can be used by threat actors for initial access or persistence. This rule specifically looks for the 'ImageLoaded' event where the loaded file has a '.wll' extension and the 'Image' (process) is 'winword.exe'.
Detects an initiated network connection by a non-browser process on the system to "azurewebsites.net". This domain has been frequently used by threat actors for malware hosting and data exfiltration. The rule filters out connections made by common web browsers and other legitimate applications to reduce false positives.
This rule detects the execution of the BOINC client binary when it has been renamed from its original filename 'BOINC.exe'. Adversaries may rename legitimate binaries to evade detection, often as part of defense evasion tactics. This specific detection looks for processes where the original filename is 'BOINC.exe' but the executed image path does not end with '\BOINC.exe'.
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Detects the creation of processes where the image name ends with '.exe' but the full path is missing or malformed, indicating an attempt to evade image-based detections. This can be used by adversaries to masquerade malicious processes.
This rule detects the execution of the Microsoft Teams application when its executable file has been renamed. Adversaries may rename legitimate application binaries to evade detection mechanisms that look for specific file names or paths. The rule specifically looks for processes where the original file name (as embedded in the executable metadata) is 'msteams.exe' or 'teams.exe', but the actual executed image path does not end with these legitimate names, indicating a renaming activity.
Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.
Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers
Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.
Page 325 of 680