SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,512 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects various Windows Update errors, including failures to connect to the update service, installation failures, uninstallation failures, revert failures, and commit failures. Monitoring these events is crucial to ensure that critical security updates are being successfully applied to systems. Persistent errors could indicate issues with network connectivity, compromised update services, or attempts to prevent system patching, which could leave systems vulnerable to known exploits.
Detects cases where ngrok, a legitimate reverse proxy tool, is used to forward traffic to the local Remote Desktop Protocol (RDP) port. This activity can indicate malicious behavior, as adversaries often use tools like ngrok for command and control, bypassing firewalls, or establishing persistent remote access to compromised systems.
Detects suspicious WMI event filter and command line event consumer creation or modification based on WMI and Security Logs. This rule specifically looks for EventID 5861 (WMI filter to consumer binding) and EventID 5859 (WMI filter registration) in conjunction with common consumer keywords like 'ActiveScriptEventConsumer' and 'CommandLineEventConsumer'. It excludes legitimate SCM Event Provider activity.
Detects password dumper activity by monitoring remote thread creation (EventID 8) where the target process is 'lsass.exe'. The process initiating the remote thread is the malicious program. A single execution of such a tool can generate numerous events.
Detects the creation of a remote thread by 'Ttdinject.exe', which can be abused as a proxy to execute malicious code. This technique is often used for defense evasion.
This rule detects DNS queries made by the Azure Hybrid Connection Manager service to the Azure Service Bus service. This activity is considered suspicious because it could indicate an attempt to establish persistence or exfiltrate data through a compromised Hybrid Connection Manager, leveraging the Service Bus as a communication channel.
This rule detects the deletion of TeamViewer log files. Adversaries may delete these logs to remove forensic evidence of their activity, making it harder to trace their actions or identify their presence on a system. The rule specifically looks for file deletion events where the target filename contains "\TeamViewer_" and ends with ".log", while excluding deletions performed by 'C:\Windows\system32\svchost.exe' to reduce false positives.
Detects the deletion of Apache Tomcat web server logs, which could indicate an adversary attempting to remove forensic evidence of their activities on the server. The rule specifically looks for deletion events targeting files within paths containing '\Tomcat\logs\' and filenames matching common Tomcat log patterns like 'catalina.', '_access_log.', or 'localhost.'.
This rule detects the creation of files with names commonly associated with credential dumping tools or the output files generated by such tools. This includes executables of known credential dumpers like fgdump, pwdump, cachedump, procdump, and Windows Credential Editor (WCE), as well as output files like 'fgdump-log', 'kirbi', 'pwdump', 'pwhashes', 'wce_ccache', 'wce_krbtkts', 'NTDS.out', 'SAM.out', 'SECURITY.out', and 'SYSTEM.out'.
This rule detects the creation of executable files with suspicious names or extensions. Specifically, it looks for files ending with '.exe' that are appended to common system directory names (e.g., ':\$Recycle.Bin.exe', ':\MSOCache.exe') or other executable extensions (e.g., '.bat.exe', '.sys.exe'). This pattern is often used in unquoted service path vulnerabilities or to masquerade malicious executables as legitimate system files.
Page 457 of 680