SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the unexpected termination of important Windows services, specifically targeting 'Message Queuing' (MSMQ) service. This could indicate an attempt to disrupt critical system functions or evade detection by stopping services that might be monitoring activity or providing essential communication channels.
This rule detects when exclusions are added to Windows Defender. Adversaries often add exclusions to security software to prevent their malicious tools and activities from being detected. This specific rule looks for Event ID 5007, which indicates a change in the antimalware platform configuration, and checks if the new configuration value contains the string '\Microsoft\Windows Defender\Exclusions'. This indicates that a path or file has been added to Windows Defender's exclusion list.
Detects when Windows Defender's Antimalware Scan Interface (AMSI) triggers an alert, indicating that it has detected malware or other potentially unwanted software. This rule specifically looks for Event ID 1116 with the SourceName 'AMSI' from the Windows Defender log source.
Detects the creation of an Alternate Data Stream (ADS) named ':Zone.Identifier' within the WinGet temporary directory, specifically when the ZoneId is '3' (Internet) and the source URL contains suspicious IP address patterns (e.g., '://1', '://2', etc.). This indicates a file downloaded from the internet via WinGet that might originate from an untrusted or suspicious source, potentially used for defense evasion or persistence.
Detects the creation of an "Active Directory Schema Cache File" (.sch) by an uncommon process. This activity can be indicative of tools performing Active Directory-related operations, potentially for reconnaissance or command and control, such as LDAPFragger. The rule filters out common legitimate processes that create these files.
Detects the creation of specific files commonly associated with Mimikatz, a credential dumping tool. Specifically, it looks for files ending with '.kirbi' (Kerberos tickets) or named 'mimilsa.log' (related to MemSSP). This activity often indicates an attempt to steal Kerberos credentials or other sensitive authentication information.
This rule detects the creation of screensaver files (.scr) in locations outside of standard Windows system directories. Attackers often leverage .scr files, which are essentially executable files, to deliver and execute malicious payloads. By filtering out common legitimate system paths, the rule aims to identify suspicious instances where an .scr file might be dropped or created by an adversary, potentially as part of a defense evasion or execution technique. The rule's description specifically mentions the use of "rundll32.exe desk.cpl,InstallScreenSaver" as an example of how an attacker might execute such a file.
Detects the creation of new PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories. This activity can indicate an adversary attempting to establish persistence or load malicious modules.
Detects the creation of a specific DLL file ('api-ms-win-core-kernel32-legacy-l1.DLL') within a user's temporary directory. This pattern is indicative of a User Account Control (UAC) bypass technique that leverages NTFS reparse points and DLL hijacking, often associated with tools like UACMe (specifically UACMe 36). The rule looks for the exact file path in a user's AppData\Local\Temp directory.
This rule detects a specific User Account Control (UAC) bypass technique leveraging the Windows Media Player component. Specifically, it looks for the creation of a file named 'OskSupport.dll' within a user's temporary directory, combined with 'DllHost.exe' accessing 'osk.exe' located in the Windows Media Player directory. This pattern is indicative of the UACMe tool's method 32, which exploits a vulnerability related to Windows Media Player to elevate privileges without user interaction.
Page 483 of 680