SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,608 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects changes to the "MaxMpxCt" registry value, which specifies the maximum outstanding network requests for the server per client when negotiating an SMB connection. Ransomware threat actors, specifically BlackCat, have been observed increasing this value to handle a higher volume of traffic, potentially for data exfiltration or other high-volume network activities.
This rule detects indicators of potential exploitation of CVE-2023-27997, a critical Fortigate SSL VPN vulnerability. It specifically looks for GET or POST requests to '/remote/hostcheck_validate' or '/remote/logincheck' URIs that also contain the 'enc=' parameter in the query string. These patterns are associated with attempts to exploit the vulnerability.
ServiceDLL Hijack
Sigma
Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence by adversaries to execute malicious payloads as part of persistence or privilege escalation. The rule specifically looks for modifications to the ServiceDll registry key within the Windows Services hive, while filtering out common legitimate modifications related to printing, domain controllers, and system updates.
Detects exploitation attempts of the OWASSRF variant targeting Exchange servers. This variant uses the OWA endpoint to access the PowerShell backend endpoint, indicated by specific URI patterns and HTTP methods. The rule filters out common legitimate user agents to reduce false positives.
This rule detects attempts to change the 'Altitude' registry value for the Sysmon driver instance. Modifying this value can prevent Sysmon from loading correctly at boot if the new altitude conflicts with other registered services, effectively disabling or impairing its monitoring capabilities. This technique is often used by adversaries to evade detection.
Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. Attackers can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files, which can be abused for persistence. The rule specifically looks for modifications to registry keys related to PersistentHandler and CLSID, while filtering out known legitimate system paths and default IFilter CLSIDs to reduce false positives.
Detects the creation of files with suspicious extensions (e.g., .bat, .dll, .exe, .hta, .js, .ps1, .vbe, .vbs) within the Windows Public user folder. This activity can indicate an adversary staging malicious scripts or binaries in a location accessible to all users, potentially for execution or further distribution.
Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges
Detects the execution of `cmd.exe` with output redirection (`>`) to suspicious locations such as temporary directories, user profile directories, or `ProgramData`. This technique is often used by adversaries to save the output of reconnaissance commands (e.g., `hostname`, `dir`) to files for later exfiltration, helping them evade immediate detection by storing command output in less scrutinized locations.
Detects the execution of a renamed "NirCmd.exe" binary based on its original filename metadata. This rule specifically looks for instances where the 'OriginalFileName' field in the process creation event is 'NirCmd.exe', but the actual executed image path does not end with 'nircmd.exe' or 'nircmdc.exe'. This indicates an attempt to evade detection by renaming the legitimate NirCmd utility.
Page 360 of 680