SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects attempts by processes to access the microphone and webcam by monitoring specific registry key access events. It looks for EventIDs 4657, 4656, or 4663 associated with registry paths related to the Windows Capability Access Manager's consent store for microphone and webcam access by non-packaged applications. This can indicate an adversary attempting to collect audio or video from the endpoint.
Detects attempts to extract the LSA secret DPAPI domain backup key from Domain Controllers. This activity is indicative of an adversary trying to gain access to sensitive cryptographic keys that can be used to decrypt DPAPI-protected data across the domain.
Detects attempts to back up the Data Protection Application Programming Interface (DPAPI) Domain Master Key. This event is generated at the source machine, not the Domain Controller, indicating a potential attempt to gain access to encrypted data.
Detects failed Kerberos TGT issue operations. This can be a sign of manipulations of TGT messages by an attacker, potentially indicating attempts to exploit Kerberos for credential access or to bypass authentication mechanisms.
Detects when a password-protected ZIP archive is opened or extracted on a Windows system. This is identified by EventID 5379 from the Security log, specifically looking for 'Microsoft_Windows_Shell_ZipFolder:filename' in the TargetName field. The rule filters out events originating from '
Temporary Internet Files\Content.Outlook' to reduce false positives.
Temporary Internet Files\Content.Outlook' to reduce false positives.
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs. This rule specifically looks for Event ID 4662, indicating an operation on an object, where the ObjectType is 'WMI Namespace' and the ObjectName contains 'subscription'. This combination is indicative of WMI persistence mechanisms being created or modified.
This rule detects the exploitation of a specific NTFS vulnerability that causes file system corruption. The detection is based on Windows System event logs, specifically Event ID 55 from the 'Ntfs' provider, indicating a corrupted file record with the file name being a single backslash.
Detects the installation and execution of the 'csexecsvc' service, which is associated with the CSExec tool. This rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, indicating a service installation, and correlates it with the service name 'csexecsvc' or an image path ending with '\csexecsvc.exe'.
This rule detects attempts to discover DNS servers within a network using LDAP queries. Specifically, it looks for DNS queries where the query name starts with '_ldap.' and the query originates from an uncommon or suspicious application. The rule filters out queries from common system processes, known legitimate applications (like Microsoft Defender), and browsers to reduce false positives. The intent is to identify adversaries performing reconnaissance to map out network infrastructure.
Detects suspicious file types (such as web shells, scripts, or executables) being dropped by the IIS worker process (w3wp.exe) associated with Microsoft Exchange. This behavior is indicative of successful exploitation of Exchange vulnerabilities, often leading to the deployment of web shells for persistent access.
Page 435 of 680