SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,520 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious modifications to sensitive or critical system files on Linux systems. This rule monitors for common command-line utilities (like 'cat', 'echo', 'grep', 'vi', 'nano', 'sed') being used with output redirection ('>') or directly to edit files within critical system directories and configuration files. This activity could indicate an attacker attempting to alter system behavior, maintain persistence, or escalate privileges by modifying files that are not expected to change without explicit administrative planning.
This rule identifies when an Azure Firewall resource is created, modified, or deleted within an Azure subscription. This activity is captured through Azure Activity Logs, specifically looking for 'MICROSOFT.NETWORK/AZUREFIREWALLS/WRITE' (for creation/modification) and 'MICROSOFT.NETWORK/AZUREFIREWALLS/DELETE' operations. Such changes can indicate legitimate administrative actions or potentially malicious attempts to alter network defenses.
Detects command line parameters indicative of Koadic hack tool execution. Specifically, it looks for 'cmd.exe' being executed with '/q', '/c', and 'chcp' in the command line, which is a known pattern used by Koadic for stager execution.
This rule detects authentication attempts (both successful and failed) originating from a host with a 16-character alphanumeric workstation name, specifically looking for NTLM authentication. This pattern is characteristic of Metasploit's SMB modules, which often generate random 16-character workstation names during authentication attempts. The rule aims to identify potential lateral movement or reconnaissance activities using Metasploit against Windows systems.
Detects the execution of Impacket's psexec.py by monitoring for specific file share access patterns on the IPC$ share. The rule looks for EventID 5145 (a detailed file share access event) where the ShareName is '\\*\IPC$' and the RelativeTargetName contains 'RemCom_stdin', 'RemCom_stdout', or 'RemCom_stderr'. These file names are characteristic of how Impacket's psexec.py communicates with the remote service.
Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an application's UI.
One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc.
The tool allows a user to provide a DLL that can contain a custom "verification routine". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility.
One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc.
The tool allows a user to provide a DLL that can contain a custom "verification routine". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility.
Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths.
This rule detects activity related to AzureHound, a BloodHound data collector specifically designed for Microsoft Azure environments. It identifies AzureHound's presence by looking for its default 'User-Agent' string in Azure sign-in logs after a successful authentication (ResultType: 0). This indicates that an authenticated user or service principal is using AzureHound to enumerate Azure resources, which is often a precursor to further reconnaissance or privilege escalation within a cloud environment.
Detects attempts to dump Active Directory credentials using Impacket's secretdump tool. This rule specifically looks for Event ID 5145 (A network share object was checked to see whether client can be granted desired access) on the ADMIN$ share, combined with access to a temporary file within the SYSTEM32 directory. This pattern is indicative of secretdump's remote activity to extract credential hashes.
This rule detects the execution of BloodHound and SharpHound, which are reconnaissance tools used to map Active Directory environments. It identifies these tools by their product name, description, company name, executable image names, and specific command-line arguments often used for data collection, such as 'CollectionMethod All', '--Loop', '--PortScanTimeout', '-JsonFolder', '-ZipFileName', 'DCOnly', and '--NoSaveCache', as well as PowerShell cmdlets like 'Invoke-Bloodhound' and 'Get-BloodHoundData'.
Page 401 of 680