SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects attempts to request a handle to the Security Account Manager (SAM) registry hive. Accessing the SAM hive can indicate an adversary attempting to dump credentials.
This rule detects attempts to access specific registry keys associated with the Windows Local Security Authority (LSA) to calculate the SysKey. SysKey is a critical encryption key used to protect sensitive system information, including password hashes. Adversaries may attempt to extract the SysKey to decrypt credentials or other sensitive data stored in the LSA, often as part of credential dumping activities. The rule specifically looks for Security Event IDs 4656 (A handle to an object was requested) or 4663 (An attempt was made to access an object) where the ObjectType is 'key' and the ObjectName ends with 'lsa\JD', 'lsa\GBG', 'lsa\Skew1', or 'lsa\Data'. These registry paths are known locations where SysKey components are stored.
Detects when important scheduled tasks are deleted or disabled. Adversaries may delete or disable scheduled tasks to hinder defensive capabilities, stop legitimate services, or prevent forensic analysis. This rule specifically targets tasks related to system restore, Windows Defender, BitLocker, Windows Backup, and Windows Update, which are critical for system integrity and security.
This rule detects the mounting of a volume shadow copy, specifically looking for Event ID 98 from the Microsoft-Windows-Ntfs provider where the DeviceName contains 'HarddiskVolumeShadowCopy'. Adversaries may mount volume shadow copies to access files, including credential stores like the Security Account Manager (SAM) database, without directly interacting with the live file system, which can bypass some security controls.
Detects when the 'Windows Defender Threat Protection' service is disabled or stopped. This event is triggered when the service state changes to stopped, which could indicate an attempt to impair defenses.
Detects various obfuscated PowerShell IEX invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for regex patterns in the ImagePath field of Event ID 7045 (Service Creation) that are characteristic of Invoke-Obfuscation's techniques to hide PowerShell commands.
Detects the obfuscated use of clip.exe to execute PowerShell commands. This technique involves creating a new service that uses 'cmd' and 'clip.exe' in conjunction with PowerShell's clipboard functionality to execute code, often as a method of defense evasion.
Detects the creation of a new Windows service where the ImagePath contains either 'Clipboard' or 'i', which could indicate an attempt to obfuscate PowerShell commands using techniques like Invoke-Obfuscation. This rule specifically looks for EventID 7045 from the 'Service Control Manager' provider.
Detects suspicious service installations by monitoring Event ID 7045 from the Service Control Manager. The rule looks for specific command-line patterns in the ImagePath field that are commonly associated with malicious service creation, such as PowerShell download commands, hidden windows, or execution from temporary directories.
Detects Windows services that terminate with an error, which can indicate issues with the service itself, or malicious activity attempting to disrupt or disable services. This rule specifically looks for Event ID 7023 from the 'Service Control Manager' provider.
Page 482 of 680