SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
ISO Image Mounted
Sigma
This rule detects when an ISO image is mounted on a Windows endpoint. It specifically looks for Event ID 4663 (An attempt was made to access an object) where the ObjectServer is 'Security', ObjectType is 'File', and the ObjectName starts with '\Device\CdRom'. The rule filters out common legitimate files found on mounted ISOs, such as 'autorun.ico', 'setup.exe', and 'setup64.exe', to reduce false positives. This activity can be indicative of an adversary using ISO images to bypass Mark-of-the-Web (MOTW) protections and deliver malicious payloads.
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory with specific access rights (0x705) and an object type of 'SAM_DOMAIN'. This activity is indicative of tools or techniques used to dump credentials from LSASS, a common method for adversaries to obtain user credentials.
Detects the use of NTLMv1 for authentication between a client and server. NTLMv1 is an insecure authentication protocol due to its susceptibility to brute-force attacks against its underlying encryption algorithms. This rule identifies events logged by the LsaSrv provider indicating NTLMv1 usage.
This rule detects the presence of keywords commonly associated with well-known PowerShell exploitation frameworks such as Mimikatz and Metasploit within PowerShell script blocks. The keywords indicate attempts to perform privileged operations like manipulating access tokens, reading process memory, or other actions typically involved in credential dumping and privilege escalation. Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware. Specifically, it looks for commands that disable boot status policy to ignore all failures and disable recovery enabled.
Detects the execution of TTDInject.exe, a legitimate Windows utility used for time travel debugging. This tool can be abused for proxy execution of malicious payloads, bypassing application control solutions.
Detects the use of 'netsh.exe' commands to disable the Windows firewall. This includes commands targeting both the legacy 'firewall' context and the 'advfirewall' (Windows Defender Firewall with Advanced Security) context, specifically looking for parameters that set the firewall state to disabled or off.
This rule detects PowerShell execution where the command line contains Base64 encoded strings that decode to 'Invoke-' keywords. It specifically looks for both UTF-8 and UTF-16 Little Endian (LE) encodings of 'Invoke-' when PowerShell or pwsh.exe is executed with the '-e' (encoded command) flag. This technique is commonly used by adversaries to obfuscate malicious PowerShell commands.
This rule detects the creation of potentially suspicious child processes by WinRAR.exe. Adversaries may exploit vulnerabilities in WinRAR, such as CVE-2023-38831, to achieve arbitrary code execution. This rule specifically looks for WinRAR.exe spawning common scripting or execution binaries like cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, and wscript.exe. Such activity is highly indicative of an adversary attempting to execute further commands or payloads after exploiting WinRAR.
This rule detects attempts to disable the Microsoft Defender Firewall by modifying specific registry keys. It looks for changes to the 'EnableFirewall' DWORD value to '0x00000000' (disabled) within the FirewallPolicy profiles (DomainProfile, PublicProfile, StandardProfile) under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\.
Page 428 of 680