SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,512 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of the 'jamf' binary with specific commands that could be used by attackers for privilege escalation, bypassing security controls, or modifying system configurations. This includes creating user accounts, managing the JAMF framework, removing MDM profiles, resetting passwords, and setting computer names.
This rule detects the execution of system commands commonly used to shut down, reboot, or halt a macOS system. Adversaries may use these commands to disrupt system availability or aid in the destruction of systems.
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed. This change is often a precursor to adversaries executing operating system commands via SQL Server.
This rule detects the creation or modification of AppX packages in suspicious file system locations. Adversaries may place malicious AppX packages in common temporary or public directories to evade detection or achieve persistence. The rule specifically looks for Event ID 854 from the 'appxdeployment-server' service, indicating an AppX package being added to the processing pipeline, and checks if the package's path contains known suspicious locations such as public user directories, temporary folders, or desktop/downloads folders.
Detects a BITS transfer job downloading file(s) from a direct IP address. This technique is often used by adversaries for defense evasion and persistence, as BITS jobs can operate in the background, bypass some firewall rules, and persist across reboots.
Detects DNS queries to "ufile.io", which has been observed as a method for data exfiltration by malware and threat actors. This rule specifically looks for Event ID 3008 in the Microsoft-Windows-DNS Client Events/Operational log where the QueryName contains 'ufile.io'.
Detects the creation of a local hidden user account on Windows systems. Hidden accounts are often indicated by a dollar sign ($) at the end of the username and can be used by adversaries for persistence.
This rule detects attempts by non-system users to obtain a handle to the Service Control Manager (SCM) database, specifically targeting the 'ServicesActive' object with a broad access mask (0xf003f). This activity can indicate an adversary attempting to enumerate or manipulate services on a Windows system.
Detects a user log-off activity. This rule can be used to correlate information during forensic investigations by identifying when a user session ends. It specifically looks for Windows Event IDs 4634 (An account was logged off) and 4647 (User initiated logoff).
Page 456 of 680