SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,618 copies16 likes160,617 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects Active Directory enumeration activity using the AdFind tool with specific command-line flags to discover password policies, enumerate Active Directory administrators, or enumerate Exchange AD objects. This activity is often associated with reconnaissance phases of an attack.
Detects Kapeka backdoor process execution pattern, where the dropper launches the backdoor binary by calling rundll32.exe and passing the backdoor's first export ordinal (#1) with a "-d" argument. The rule specifically looks for rundll32.exe executing a .wll file from common temporary or application data directories like ProgramData or AppData\Local, combined with the ordinal #1 and a "-d" argument.
This rule detects attempts to proxy web pages through the HTTPPROXY service on an OpenCanary honeypot. This indicates that an attacker or automated tool has interacted with the honeypot's HTTP proxy, potentially attempting to use it for further malicious activity or reconnaissance.
Detects an attempt to leverage dnscmd.exe to enumerate DNS zones or records of a domain. This activity can be indicative of reconnaissance by an attacker.
Detects the creation of files with specific naming patterns and paths commonly used by the post-exploitation tool CrackMapExec. This includes PowerShell scripts like 'temp.ps1' and 'msol.ps1' in the 'C:\Windows\Temp\' directory, as well as temporary files with UUID-like or 8-character alphanumeric names.
Detects an attacker trying to enable the Outlook security setting "EnableUnsafeClientMailRules" which allows Outlook to run applications or execute macros. This setting can be manipulated via the command line, typically through registry modification commands.
Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers\" registry key. The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.
Detects when a Kubernetes CronJob or Job is created or modified.
A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule.
An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.
A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule.
An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.
Detects file access requests to the Windows Credential History File by an uncommon application.
This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function
This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function
Detects file access requests to crypto currency files by uncommon processes.
Could indicate potential attempt of crypto currency wallet stealing.
Could indicate potential attempt of crypto currency wallet stealing.
Page 337 of 680