SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,618 copies16 likes160,616 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects HTTP requests to low reputation Top-Level Domains (TLDs) or for files with suspicious extensions, which may indicate an attempt to download malicious content or establish command and control.
Detects the creation of JavaScript files within the Windows DriverStore directory. This activity has been observed in attacks by the Forest Blizzard APT (also known as Star Blizzard) to exploit CVE-2022-38028 in the Windows Print Spooler service. The adversary modified a JavaScript constraints file and executed it with SYSTEM-level permissions to achieve privilege escalation and credential access.
Detects the execution of Notepad to open a file that has the string "password" in its name and a common extension (txt, csv, doc, xls). This activity may indicate unauthorized access to credentials or suspicious reconnaissance.
Detects the 'RegAsm.exe' utility initiating an outbound network connection to a public IP address. RegAsm.exe is a legitimate Microsoft utility used to register .NET assemblies, but it can be abused by adversaries for defense evasion and proxy execution, especially when making unexpected network connections.
Detects the deletion of files commonly used for backups by adversaries to prevent system recovery. This rule specifically looks for deletion actions performed by common Windows command-line interpreters and system utilities on files with backup-related extensions.
Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files before deletion, specifically files ending with '.AAA' or '.ZZZ'.
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.). This technique is often used to dump LSASS memory for credential access.
Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250. This vulnerability allows for privilege escalation.
Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec
Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.
Page 354 of 680