SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,518 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects potential abuse of ntdsutil or similar methods to dump the ntds.dit database. This activity is often associated with credential dumping from Active Directory.
Detects when a stored procedure in MSSQL is configured for automatic execution upon SQL Server startup using `sp_procoption`. This can be used by adversaries to establish persistence.
This rule detects when a USB device is plugged in or unplugged by monitoring specific event IDs from the Microsoft-Windows-DriverFrameworks-UserMode/Operational event log. Event ID 2003 indicates driver loading, while Event IDs 2100 and 2102 relate to Plug and Play (PnP) or power management events, which are typically generated when a USB device is connected or disconnected.
Detects potential MuddyWater APT activity involving the use of mshta for execution, PowerShell for system information discovery (operating system, network configuration, security center), and a PowerShell-based backdoor with base64 encoding and web requests.
This rule detects successful password spray activity. A password spray attack involves an adversary attempting a single or small list of commonly used passwords against many different accounts to acquire valid credentials, often to avoid account lockouts. The detection specifically triggers when Azure AD Identity Protection identifies a 'passwordSpray' risk event.
This rule detects suspicious command-line patterns indicative of reverse shell attempts. It looks for various common techniques used to establish a reverse shell, including bash, sh, netcat, socat, Perl, Python, Ruby, and PHP one-liners that connect back to an attacker-controlled host. The rule also includes patterns for xterm reverse shells and specific shell commands often used in conjunction with reverse shells.
This rule detects when an external disk drive or a USB mass storage device is recognized by the system. It specifically looks for Windows Security Event ID 6416, which indicates that a new external device was recognized, and further filters for devices classified as 'DiskDrive' or with the description 'USB Mass Storage Device'. This can be an indicator of initial access, data exfiltration, or the introduction of malicious software via removable media.
This rule detects the creation of an Alternate Data Stream (ADS) that contains an executable file. It specifically looks for the presence of a non-empty Import Hash (Imphash) within the created stream, indicating executable content. The rule filters out streams with a null Imphash, which typically correspond to non-executable data.
This rule detects the execution of well-known DNS exfiltration and tunneling tools, specifically 'iodine.exe' and 'dnscat2'. These tools are commonly used by adversaries to establish covert communication channels over DNS, allowing for data exfiltration and command and control activities that might bypass traditional network defenses.
Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule. This can be used by adversaries for lateral movement, defense evasion, or command and control.
Page 407 of 680