SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when a kernel module that does not meet WHQL (Windows Hardware Quality Labs) signing requirements is loaded into the system. This can indicate the presence of unsigned or improperly signed drivers, which might be malicious or unstable. The rule specifically looks for Code Integrity Event IDs 3082 and 3083, which signify that such a module was loaded, even if allowed due to auditing policy.
Detects network access to the 'protected_storage' service, specifically targeting the IPC$ share. This activity is often associated with attempts to extract DPAPI domain backup keys from Domain Controllers, a technique used for credential access and lateral movement.
Detects inbound network connections to ports 5985 or 5986, which are commonly used for PowerShell Remoting (WinRM). This rule specifically looks for EventID 5156 (Windows Filtering Platform Connection) with a LayerRTID of 44, indicating an inbound connection.
Detects reconnaissance activity involving attempts to enumerate domain administrator accounts and domain groups. Specifically, it looks for Event ID 4661 (An operation was performed on an object) with an AccessMask of '0x2d' (which indicates a read access attempt) on SAM_USER or SAM_GROUP objects whose ObjectName corresponds to well-known SIDs for the built-in Administrator account (-500) or Domain Admins group (-512) within a domain (S-1-5-21- prefix). This activity is often associated with adversaries using commands like 'net user administrator /domain' or 'net group domain admins /domain' to discover privileged accounts.
Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.
This rule detects the creation of a remote thread within the KeePass.exe process. This activity is highly suspicious as it can indicate an attacker attempting to inject malicious code into KeePass to extract sensitive information, such as master passwords or stored credentials. This technique is commonly used by tools like KeeFarce and KeeThief for password dumping from KeePass.
Detects the use of the NPPSpy hacktool by monitoring for the creation of its characteristic output files, 'NPPSpy.txt' or 'NPPSpy.dll'. This tool is known to capture cleartext credentials from users logging into a local system.
Detects process activity patterns indicative of the Sliver C2 framework implants. Specifically, it looks for command-line arguments used by Sliver to execute PowerShell with specific encoding settings.
Detects PowerShell command line patterns in combination with encoded commands that often appear in malware infection chains. This rule specifically looks for PowerShell or pwsh executable names combined with common encoded command flags (-e, -enc, etc.) and specific Base64 encoded strings frequently seen in malicious payloads.
Detects the use of 'reg.exe' to add or copy registry keys within the 'SafeBoot' path. This activity is often associated with ransomware attempting to ensure persistence or functionality in Windows Safe Mode, potentially to bypass security products that do not operate in that mode.
Page 431 of 680