SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,618 copies16 likes160,616 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecureDesktop" value. The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that's isolated from other processes running on the system. It's designed to prevent malicious software from intercepting or tampering with UAC prompts. When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user's current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software.
Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive using the `wbadmin.exe` utility. Attackers can leverage `wbadmin` to dump sensitive files that might contain credentials or other sensitive information.
Detects the enabling of the Windows Recall feature by deleting the "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host and is subsequently enabled by an adversary.
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
Detects when a user attaches a Lambda layer to an existing AWS Lambda function. A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role, potentially granting an adversary access to resources the function has access to. This activity could indicate privilege escalation or unauthorized modification of serverless functions.
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. This rule helps identify potential suspicious processes that have escalated privileges.
This rule detects when a Python process initiates an outbound network connection. While this activity can be legitimate for tasks like package installation or updates, it can also be indicative of malicious behavior, such as a Python-based script establishing communication with a command and control (C2) server or performing network reconnaissance. The rule includes filters to reduce false positives from common activities like Anaconda updates, Jupyter Notebook local communication, and 'pip install' commands.
Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil".
An attacker can use this to prevent backups from occurring.
An attacker can use this to prevent backups from occurring.
Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors
This rule detects suspicious parent processes for a set of well-known Windows system processes. It specifically looks for instances where `svchost.exe`, `taskhost.exe`, `lsm.exe`, `lsass.exe`, `services.exe`, `lsaiso.exe`, `csrss.exe`, `wininit.exe`, or `winlogon.exe` are spawned by a parent process that is not typically expected. The rule filters out legitimate parent processes such as those from security products (e.g., `SavService.exe`, `MsMpEng.exe`), common system directories (`System32`, `SysWOW64`), and cases where the parent process is null or empty.
Page 350 of 680