SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,618 copies16 likes160,617 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.
Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.
Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.
Detects the execution of the SharpDPAPI tool based on command-line flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project, used for extracting credentials and other sensitive information.
This rule detects the execution of 'BrowserCore.exe' when its filename has been changed from the original. Adversaries may rename this legitimate utility, which is known to be used for extracting Azure tokens, to evade detection. The rule specifically looks for processes where the original filename is 'BrowserCore.exe' but the executed image path does not end with '\BrowserCore.exe'.
Detects potential tampering with Windows Defender settings, such as adding exclusions, using the wmic.exe utility. This activity can be indicative of an adversary attempting to impair defenses to avoid detection.
Detects the execution of the AdFind.exe utility, which is commonly used for reconnaissance in Active Directory environments. The rule identifies AdFind.exe by its image name, original filename, and specific IMPHASH values.
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
This rule detects the execution and usage of the DSInternals PowerShell module. DSInternals is a powerful tool that exposes internal features of Active Directory and Azure Active Directory, enabling actions such as dumping DPAPI backup keys, manipulating NTDS.DIT files, auditing FIDO2 and NGC keys, performing password auditing, and recovering Domain Controllers from IFM backups. The rule specifically looks for a wide range of DSInternals cmdlets being executed via the command line.
Detects changes to the HypervisorEnforcedCodeIntegrity registry key where the "Enabled" value is set to 0, which disables the Hypervisor Enforced Code Integrity (HVCI) feature. Disabling HVCI allows an attacker to load unsigned and untrusted code into the kernel, potentially facilitating privilege escalation or defense evasion.
Page 338 of 680