SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the Hybrid Connection Manager service running on a Windows endpoint. It specifically looks for Event IDs 40300, 40301, or 40302 in conjunction with keywords like 'HybridConnection', 'sb://', 'servicebus.windows.net', or 'HybridConnectionManage'. This service is used to connect on-premises resources to Azure services, and its activity could indicate legitimate cloud integration or potentially malicious use for persistence or data exfiltration.
This rule detects when a file is restored from quarantine by Microsoft Defender Antivirus. This action is logged with Event ID 1009 in the Microsoft-Windows-Windows Defender/Operational event log. While legitimate administrators might restore files, this event can also indicate an adversary attempting to reintroduce malicious files that were previously quarantined, potentially as part of a defense evasion strategy.
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non-browser process. This behavior can indicate reconnaissance activity by malware or an attacker attempting to determine the external IP address of a compromised system.
This rule detects the creation of a file named 'dumpert.dmp', which is the default output file used by the Outflank Dumpert tool. Dumpert is a process dumper specifically designed to extract memory from the Local Security Authority Subsystem Service (LSASS) process, which often contains sensitive credential material.
This rule detects instances where the 'winlogon.exe' process initiates outbound network connections to public IP addresses. Winlogon.exe is a critical Windows component responsible for user logon/logoff and the secure attention sequence. Typically, winlogon.exe should not be making outbound network connections to public IPs. Such activity could indicate compromise, potentially by malware like BlackLotus, which has been observed to leverage winlogon.exe for malicious purposes, including command and control or data exfiltration.
This rule detects specific code artifacts commonly found in offensive PowerShell payloads such as Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, and PowerSploit. These artifacts often remain unchanged due to poor operational security practices by attackers. The rule looks for specific strings like '$DoIt', 'harmj0y', 'mattifestation', '_RastaMouse', 'tifkin_', and '0xdeadbeef' within PowerShell script payloads.
This rule detects suspicious PowerShell invocations by looking for specific command parameters that indicate obfuscation, hidden execution, or non-interactive sessions. Specifically, it flags the use of encoded commands (`-enc`, `-EncodedCommand`, `-ec`), hidden window styles (`-w hidden`, `-window hidden`, `-windowstyle hidden`, `-w 1`), and non-interactive flags (`-noni`, `-noninteractive`). These parameters are commonly used by adversaries to conceal their activities and bypass detection.
This rule detects the execution of Mimikatz by identifying specific command-line arguments and keywords commonly associated with its various modules and functions. It looks for terms like 'DumpCreds', 'mimikatz', and module-specific keywords such as '::aadcookie', '::detours', 'sekurlsa::', 'kerberos::', and 'lsadump::'. The rule aims to identify attempts to dump credentials or perform other malicious actions using the Mimikatz tool.
Detects the execution of the Windows Problem Steps Recorder (psr.exe) with command-line arguments indicating a recording start. Psr.exe is a legitimate utility that can be abused by adversaries to capture screen activity, which is a form of information collection.
Detects the execution of '3proxy.exe', a tiny free proxy server, based on its image name, description, or specific command-line parameters. This tool can be used by adversaries for command and control activities, specifically for proxying network traffic.
Page 440 of 680