SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,512 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the download of suspicious file types from URLs containing direct IP addresses. This rule specifically looks for the creation of Zone.Identifier alternate data streams (ADS) for common executable or script file extensions, indicating a file downloaded from the internet, combined with a URL that uses an IP address instead of a domain name. This behavior can be indicative of malware delivery or staging.
This rule detects the creation of a file named "ntds.dit", which is the Active Directory database. The NTDS.dit file contains critical information including user credentials (hashed passwords), group memberships, and other Active Directory objects. Adversaries often target this file to dump credentials for lateral movement and privilege escalation within a Windows domain.
This rule detects the creation of new Microsoft Office macro-enabled files. These file types (.docm, .dotm, .xlsm, .xltm, .potm, .pptm) can contain embedded macros, which are often used by adversaries for initial access, persistence, or execution of malicious code. Monitoring their creation can help identify suspicious activity related to macro-enabled document attacks.
Detects the creation of a file named "wpbbin.exe" in the "C:\Windows\System32\" directory. This activity can be indicative of a UEFI-based persistence method used by adversaries to maintain access to a system, often by injecting executable files into the boot process, potentially bypassing security measures like BitLocker.
Detects outbound network connections to known cryptocurrency mining pool domains. This activity is often indicative of resource hijacking (cryptojacking) where an attacker uses a compromised system's resources to mine cryptocurrency without the owner's consent. The rule specifically targets a comprehensive list of domains associated with various mining pools, primarily for Monero (XMR) and other cryptocurrencies.
This rule detects PowerShell script blocks that attempt to execute batch scripts (.cmd or .bat files) using 'Start-Process'. This behavior can be indicative of an adversary abusing the Windows command shell for execution, potentially to run a series of commands or a malicious payload.
This rule detects the execution of specific PowerShell cmdlets related to Hyper-V virtual machine management. Adversaries may use these cmdlets to create, configure, or start virtual machines to evade detection by isolating malicious activities within a virtualized environment. The rule specifically looks for 'New-VM', 'Set-VMFirmware', and 'Start-VM' within PowerShell script block text.
Detects a typical pattern of a Cobalt Strike Beacon Object File (BOF) attempting to inject into other processes. This rule specifically looks for process access events where the call trace indicates a sequence from ntdll.dll to KERNELBASE.dll, followed by an unknown module, combined with specific granted access rights (0x1028 or 0x1fffff). This pattern is indicative of certain process injection techniques used by Cobalt Strike BOFs.
This rule detects remote access to the Local Security Authority Subsystem Service (LSASS) process via Windows Remote Management (WinRM). This activity is highly indicative of credential dumping attempts, often performed by tools like Mimikatz, to extract sensitive authentication material from memory. The rule specifically looks for process access events where the target process is 'lsass.exe' and the source process initiating the access is 'wsmprovhost.exe', which is associated with WinRM. It also filters out common benign access patterns (0x80000000 GrantedAccess) to reduce false positives.
Detects the execution of 'curl.exe' with the '-c' flag or '--cookie-jar' option to save cookie data. This activity can be indicative of an attacker attempting to hijack sessions by extracting authentication cookies.
Page 445 of 680