SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects when the Background Intelligent Transfer Service (BITS) creates a new transfer job that saves a local file with a potentially suspicious extension. The suspicious extensions include '.bat', '.dll', '.exe', '.hta', '.ps1', '.psd1', '.sh', '.vbe', and '.vbs'. It specifically filters out common legitimate updates from applications like Chrome and Dropbox that download files into 'AppData' directories or from '.com' domains to reduce false positives.
This rule detects when the Windows Defender Firewall service fails to load Group Policy. This event can indicate an issue with the firewall configuration being applied, potentially leading to a weakened security posture or unexpected network behavior. Adversaries might attempt to interfere with firewall policy loading to bypass defenses.
This rule detects when the Windows Defender Firewall configuration has been reset to its default settings. This action can indicate an attempt by an adversary to disable or modify firewall rules to bypass network controls, facilitate C2 communications, or enable lateral movement. It specifically looks for Event IDs 2032 (for most Windows versions) and 2060 (for Windows 11) from the firewall-as log source.
Detect standard users login that are part of high privileged groups such as the Administrator group
Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.
Detects obfuscated use of `clip.exe` to execute PowerShell commands. This technique involves leveraging the Windows clipboard utility (`clip.exe`) in conjunction with command-line arguments that include `cmd` and `clipboard]::` to launch PowerShell, often as a method of defense evasion and execution.
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory from non-system accounts, which is a common technique used by credential dumping tools like Mimikatz. The rule specifically looks for security events (4663 or 4656) related to process object access with specific access masks targeting 'lsass.exe', while filtering out legitimate system accounts and known benign processes.
This rule detects a potential Kerberos Replay Attack on domain controllers. It specifically looks for Event ID 4649, which indicates that a "KRB_AP_ERR_REPEAT" Kerberos response was sent to the client. This error signifies that the KDC detected a replay of a Kerberos Application Server (AP) request, suggesting an adversary might be attempting to reuse stolen Kerberos tickets to gain unauthorized access.
Detects the creation of suspicious local accounts that mimic the 'ANONYMOUS LOGON' account, potentially using additional spaces or other obfuscation techniques. This rule specifically targets Event ID 4720 (A security-enabled local group was created) and looks for 'ANONYMOUS' and 'LOGON' within the SamAccountName field, aiming to cover scenarios where such accounts are created to bypass detection or for malicious persistence.
Detects suspicious changes to Windows Defender's configuration settings, which could indicate an attempt to disable or impair its protective capabilities. This rule specifically looks for modifications to registry keys related to disabling anti-spyware, removable drive scanning, network drive scanning, cloud-delivered protection (Block at First Seen), and real-time protection reporting.
Page 471 of 680