SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects suspicious Windows file path strings (e.g., 'C:/Users', 'C:/Windows', 'C:/Program Files') within the URI query component of web requests. The presence of such strings in a URI could indicate an attempt to exfiltrate data from a Windows system or communicate with a webshell that is attempting to access local files or directories. The rule looks for both standard and URL-encoded variations of these paths.
Detects Windows error reporting events where the Local Security Authority Subsystem Service (LSASS) process crashes with a specific exception code. This behavior can indicate an intentional crash, often associated with techniques like Lsass-Shtinkering, to facilitate credential dumping from LSASS memory.
This rule detects the installation of Microsoft Installer (MSI) packages from suspicious file system locations. It specifically looks for MsiInstaller events (Event IDs 1040 and 1042) where the installation source path contains known suspicious directories such as Windows temporary folders, remote shares (indicated by '\\'), Desktop, PerfLogs, or Public user folders. The rule includes filters to reduce false positives from legitimate applications like WinGet or specific update health tools.
Detects when the deployment of an AppX package is blocked by an AppLocker policy. This indicates an attempt to install or run an unauthorized application package, which could be a defense evasion attempt or an attempt to introduce malicious software.
Detects the loading of a kernel driver that has been revoked by Code Integrity. This indicates an attempt to load a driver that is no longer trusted, potentially for malicious purposes or due to a known vulnerability. Event ID 3021 signifies a revoked driver load, while 3022 indicates a revoked driver load allowed due to a kernel mode debugger being attached.
This rule detects attempts to load an image (e.g., a DLL or executable) that has been blocked by Windows Code Integrity because its signing certificate has been revoked. This indicates that a potentially malicious or untrusted module is trying to execute on the system, and the operating system's integrity checks are preventing it.
This rule detects when a DNS server receives a zone transfer request for a non-existent or non-authoritative zone, indicated by EventID 6004 from the Microsoft-Windows-DNS-Server-Service. This event signifies an attempt to perform a DNS zone transfer that was rejected by the DNS server. Such attempts can be part of reconnaissance activities by adversaries trying to map out a network's DNS infrastructure.
This rule detects the installation of the 'HybridConnectionManager' service on a Windows system. This service is part of Azure Hybrid Connection Manager, which allows Azure services to connect to on-premises resources. While legitimate, its installation could also be leveraged by an attacker to establish persistence or facilitate data exfiltration from an compromised environment to Azure resources.
This rule detects the first-time use of a remote named pipe, excluding commonly known legitimate pipes. This can help identify lateral movement and remote execution attempts using named pipes, as adversaries often leverage these for inter-process communication across networked systems.
This rule detects the execution of PsExec or PAExec by monitoring network share access to the IPC$ share. Specifically, it looks for access to named pipes ending with '-stdin', '-stdout', or '-stderr', which are characteristic of PsExec/PAExec communication. The rule filters out instances where the service name starts with 'PSEXESVC', indicating the standard Sysinternals PsExec service, to reduce false positives for legitimate PsExec usage or when the attacker uses a different PsExec client.
Page 464 of 680