SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,567 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the modification of the "Ime File" registry value within the Keyboard Layouts key to point to suspicious folders. This technique can be used by attackers to load a malicious DLL into a process after sending a WM_INPUTLANGCHANGEREQUEST message, leveraging the Windows Input Method Editor (IME) feature for persistence or defense evasion. The rule specifically looks for DLL paths located in common temporary or user-writable directories, which are often abused by malware.
This rule detects the execution of various known hacktools on Linux systems by monitoring process creation events and matching against a predefined list of tool names in the 'Image' field. The tools covered include C2 frameworks (e.g., Cobalt Strike, Metasploit, Havoc, Merlin, Sliver), network scanners (e.g., Nmap derivatives, Nuclei, Recon-ng), web enumeration tools (e.g., Dirb, Ffuf, Gobuster), web vulnerability scanners (e.g., Nikto, WPSCan), and other exploit/post-exploitation tools (e.g., Aircrack-ng, Bloodhound-Python, Hashcat, Hydra, John, SQLMap, PEASS-ng).
Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.
Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.
Detects when Windows Defender Real-time Protection is disabled. This event may not contain detailed information about the initiator, requiring further investigation.
This rule detects attempts to request write access to Windows Defender exclusion registry keys. This activity is highly suspicious as it could indicate an attacker attempting to modify or add new exclusions to bypass antivirus protection. The rule specifically looks for Event IDs 4656 (handle requested) or 4663 (object access attempt) in conjunction with write-related access rights (WriteData or AppendData) on registry paths containing '\Microsoft\Windows Defender\Exclusions\'.
Detects the execution of common network scanning and reconnaissance tools on Linux systems. These tools are often used by adversaries to enumerate local or remote network services, identify open ports, and gather information about network topology and available hosts. The rule specifically looks for the execution of tools like netcat (when not in listen mode), nmap, hping, naabu, autorecon, and telnet.
Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.
Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP
Detects process access requests from hacktool processes based on their default image name
Page 390 of 680