SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of an ISO file in the Outlook temporary folder or in the AppData temporary folder. This activity is typical of Qakbot TTPs observed from late July 2022, often associated with bypassing Mark-of-the-Web controls.
Detects the creation of files with specific name patterns that are commonly used by tools like Metasploit and Impacket's secretsdump.py to export and stage the NTDS.DIT database for exfiltration. These patterns include '.ntds.cleartext' and 'All.cab', which are indicative of attempts to dump Active Directory credentials.
Detects the creation of new Outlook form files, which can be used by adversaries to establish persistence by embedding malicious code. The rule specifically looks for file creation events by 'outlook.exe' in known Outlook forms directories.
Detects suspicious activity where the MSExchangeMailboxReplication process writes .asp or .aspx files to disk. This behavior is often indicative of web shell deployment, potentially following an exploit like ProxyShell, to establish persistence or further access.
Detects instances where the svchost.exe process, specifically hosting the RDP terminal services, initiates outbound network connections to target systems on standard HTTP (TCP port 80) or HTTPS (TCP port 443) ports. This behavior is indicative of RDP tunneling, where RDP traffic is encapsulated within web protocols to bypass network restrictions or evade detection.
This rule detects attempts to delete Volume Shadow Copies using PowerShell and WMI. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially in ransomware attacks. The rule specifically looks for PowerShell commands that interact with 'Win32_ShadowCopy' via 'Get-WmiObject' and then perform a 'Delete()' operation or use 'Remove-WmiObject'.
Detects the execution of Certify, a tool used for Active Directory certificate abuse, by identifying its executable name, original file name, description in PE metadata, and specific command-line arguments related to certificate operations such as listing Certificate Authorities (CAs), finding vulnerable templates, requesting, and downloading certificates.
Detects the execution of the KrbRelay tool, a utility used for Kerberos relaying attacks. The rule identifies the tool by its executable name ('KrbRelay.exe') or its original filename, and by specific command-line arguments commonly used by KrbRelay for Kerberos relaying, including parameters related to Service Principal Names (SPN), Class IDs (CLSID), and Resource-Based Constrained Delegation (RBCD) or shadow credentials.
Detects the use of PowerShell cmdlets 'Add-MpPreference' or 'Set-MpPreference' in conjunction with parameters like '-ExclusionPath', '-ExclusionExtension', '-ExclusionProcess', or '-ExclusionIpAddress' to configure exclusions for Microsoft Defender Antivirus. This activity is often associated with defense evasion tactics used by adversaries to prevent security software from detecting their malicious activities.
Detects the execution of Nmap or Zenmap, which are network scanning tools. Adversaries commonly use these tools for network service discovery to identify open ports and services on remote hosts, potentially looking for vulnerabilities to exploit.
Page 436 of 680