SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,601 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments. Certipy can be used to enumerate Active Directory Certificate Services (AD CS) for misconfigurations, request certificates, and perform various attacks such as forging authentication certificates (ESC1, ESC2, ESC3, ESC4, ESC6, ESC7, ESC8, ESC9, ESC10). The rule looks for the executable name, original file name, description containing 'Certipy', or specific command-line arguments and flags commonly used by Certipy.
Detects when attackers or tools disable Windows Defender functionalities by modifying specific registry keys. This rule looks for changes to various Windows Defender related registry paths, specifically setting DWORD values to either 0x00000001 (to disable certain features) or 0x00000000 (to disable other features like Tamper Protection or PUA Protection).
Detects the creation of files with names commonly used by various memory dumping tools to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory. This includes specific filenames and patterns associated with tools like Procdump, MirrorDump, PPLBlade, RustiveDump, NativeDump, and Nanodump.
Detects process access requests from known hacktool processes based on their executable names. This rule targets a wide range of tools commonly used for credential dumping, privilege escalation, and other malicious activities, including Mimikatz, various Potato exploits, and other offensive security tools. The detection focuses on the 'SourceImage' field, indicating the process initiating the access.
Detects when a memory process image does not match the disk image, indicative of process hollowing. This rule specifically looks for 'Image is replaced' events and filters out common legitimate applications that might exhibit similar behavior, such as applications in 'Program Files', 'Windows\System32\wbem\WMIADAP.exe', 'Windows\SysWOW64\wbem\WMIADAP.exe', Opera, and Edge.
Detects the execution of a specific binary identified by its filename and SHA256 hash. This binary is associated with the Lace Tempest threat group and is used to load additional malware, as reported by the SysAid Team. The detection specifically looks for a process created from the path ':\Program Files\SysAidServer\tomcat\webapps\usersfiles\user.exe' or a process with the SHA256 hash 'B5ACF14CDAC40BE590318DEE95425D0746E85B1B7B1CBD14DA66F21F2522BF4D'.
Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team. The script specifically targets files related to 'usersfiles.war' and 'SysAidServer' within a Tomcat directory, indicating an attempt to clean up traces of an intrusion or exploit.
Detects command-line keywords indicative of the execution of the WinPwn tool, which is used for Windows and Active Directory reconnaissance and exploitation. This rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' in the command line.
Detects a PowerShell script used by the Lace Tempest APT group to launch their malware loader by exploiting CVE-2023-47246. The script contains specific strings related to the SysAid server path, the execution of 'user.exe', and the removal of temporary files.
This rule detects when one of the Windows Event Logs has been cleared. This activity is often performed by adversaries to remove evidence of their presence and actions on a compromised system. The detection specifically looks for Event ID 104 from the 'Microsoft-Windows-Eventlog' provider, which indicates an event log has been cleared. It filters out certain channels that might be covered by other rules to avoid redundancy.
Page 386 of 680