SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location, such as Desktop, C:\Users\Public\, or C:\PerfLogs\.
This rule detects attempts to export an Exchange Certificate Signing Request (CSR) to an unusual directory or with an .aspx file extension. This activity is suspicious because it could indicate an adversary attempting to place a webshell on an Exchange web server for persistent access. The rule specifically looks for the PowerShell cmdlet 'New-ExchangeCertificate' with parameters '-GenerateRequest', '-BinaryEncoded', and '-RequestFile', combined with suspicious file paths like '\\localhost\C$', '\\127.0.0.1\C$', 'C:\inetpub', or the '.aspx' extension.
This rule detects attempts to modify the 'ExternalUrl' property of an Exchange OabVirtualDirectory to include script-related keywords. This activity can indicate an adversary attempting to establish persistence or execute malicious code by injecting a web shell or similar mechanism into the Exchange server's Outlook Web Access (OWA) configuration.
Detects an attempt to install a device that is forbidden by the system policy, indicated by Windows Security Event ID 6423. This event signifies that a device installation was blocked due to a configured policy.
Detects obfuscated PowerShell execution via mshta.exe, specifically looking for patterns indicative of VBScript execution within mshta that creates an object and runs a command, often used for defense evasion.
Detects remote service activity by monitoring access to the 'svcctl' named pipe via the IPC$ share. This activity is indicative of an attacker attempting to interact with services on a remote system, often as part of lateral movement or persistence efforts.
This rule detects the creation of a new Windows service where the service's ImagePath contains 'powershell' or 'pwsh'. This indicates that a PowerShell script is being used as the executable for a newly installed service, which is a common technique for persistence or privilege escalation by adversaries.
Detects the installation of a service by PAExec, a remote administration tool. This rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, and then filters for service names or image paths starting with 'PAExec-'. This is a common indicator of PAExec being used to execute commands or deploy tools remotely.
Detects the installation and execution of the RemCom service, which is often used for remote administration and can be leveraged by adversaries for lateral movement or persistence.
Detects the installation of a new Windows service where the executable path contains suspicious patterns, specifically executables located directly under 'ProgramData' or the root of the C: drive with a short, potentially obfuscated name (e.g., 'C:\ProgramData\.{1,9}\.exe' or 'C:\.{1,9}\.exe'). This pattern is often used by malware for persistence and to evade detection by hiding in less common locations.
Page 491 of 680