SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,612 copies16 likes160,613 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.
Detects network connections initiated by 'dfsvc.exe', which is responsible for handling ClickOnce applications, to non-local IP addresses. This activity can be indicative of malicious ClickOnce abuse for trusted code execution, especially when connecting to external or unexpected destinations.
Detects network connections made by non-browser processes to public IP lookup services. This activity can indicate an adversary performing discovery to understand the external IP address of a compromised system, often as a post-compromise internet connectivity test or for reconnaissance purposes.
Detects instances where an MSSQL service on an OpenCanary honeypot has had a login attempt using SQL Authentication. This indicates an adversary is attempting to brute-force or test credentials against the honeypot's emulated MSSQL service.
Detects instances where an attacker attempts to interact with or exploit a REDIS service running on an OpenCanary honeypot. This indicates reconnaissance or an attempt to gain unauthorized access or extract data from the emulated Redis service.
This rule detects the creation or modification of a DLL path within the Windows Time service (W32Time) TimeProviders registry key. Adversaries may abuse this mechanism to establish persistence by registering a malicious DLL to be loaded and executed when the system boots. The rule specifically looks for changes to the 'DllName' value under 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders' and filters out known legitimate DLLs associated with the W32Time service.
Detects potential exploitation of CVE-2024-1212, an unauthenticated command injection vulnerability in Progress Kemp LoadMaster. The rule specifically looks for GET requests to the '/access/set' API with the parameters 'param=enableapi' and 'value=1', combined with an "Authorization" header containing a base64 encoded value with uncommon characters, indicative of an attempted exploit.
Detects instances where a MySQL service on an OpenCanary honeypot has had a login attempt. This indicates an adversary is attempting to gain unauthorized access to the honeypot's emulated MySQL service, which can be a sign of reconnaissance or credential stuffing activities.
This rule detects attempts to modify the "ChannelAccess" registry key, which controls access permissions for Windows event channels. Adversaries may tamper with these permissions to prevent security tools or analysts from accessing event logs, thereby hindering detection and forensic analysis. The rule specifically looks for modifications to the 'ChannelAccess' key within the 'WINEVT\Channels' registry path and identifies specific Security Descriptor Definition Language (SDDL) strings that grant 'GENERIC ALL' or 'GENERIC WRITE' permissions to local administrators, local system, or built-in administrators. This activity is often a precursor to clearing event logs or otherwise impairing defenses.
Detects usage of NimScan, a portscanner utility.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
Page 357 of 680