SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects successful attempts to exploit the IIS shortname vulnerability, which allows enumeration of folders when IIS uses an old .Net Framework. The detection logic looks for HTTP GET or OPTIONS requests to URIs containing '~1' and ending with 'a.aspx', combined with successful HTTP status codes (200 or 301). This pattern is indicative of a successful fuzzing scan for the IIS shortname vulnerability.
This rule detects attempts to enumerate source code repositories, specifically Git repositories, by looking for '.git/' in the URL of GET requests. This activity often indicates an attacker attempting to discover exposed source code.
This rule detects when an application has been uninstalled from a Windows system. It specifically looks for MsiInstaller events with EventIDs 1034 (Windows Installer removed the product) or 11724 (Product Removal Successful). This can be an indicator of an adversary attempting to remove security software or other critical applications to hinder detection or response efforts, or simply to clean up their tracks.
Detects the execution of AppX packages that have been signed with a known suspicious or malicious digital certificate. Specifically, this rule targets certificates issued to 'Foresee Consulting Inc.', which has been associated with malicious activity. This detection helps identify potentially unwanted or malicious applications attempting to run on a Windows system by leveraging compromised or misused digital signatures.
Detects DNS queries for 'anonfiles.com', which is an anonymous file upload platform frequently used for malicious purposes, including data exfiltration by malware such as BlackByte ransomware. This rule specifically looks for Event ID 3008 from the Microsoft-Windows-DNS Client Operational log, indicating a DNS query for a domain containing '.anonfiles.com'.
Detects when settings of the Windows firewall have been changed, indicated by specific Event IDs from the Windows Defender Firewall with Advanced Security log. This can be an indicator of an adversary attempting to bypass network controls.
This rule detects successful logon events (EventID 4624) where the LogonType is 9, which signifies a new credentials logon. This logon type is typically associated with the 'RunAs' command or similar functionality, where a user explicitly provides alternate credentials to execute a program or access a resource. Adversaries may use this technique to execute code with different user privileges or to move laterally within an environment using stolen or compromised credentials.
This rule detects suspicious access attempts to the registry key associated with the Azure AD Health monitoring agent. It specifically looks for Event IDs 4656 (handle to an object was requested) or 4663 (an attempt was made to access an object) on the registry key '\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent'. The rule filters out access attempts made by legitimate Azure AD Health monitoring agent processes to reduce false positives. This detection requires specific SACL auditing to be configured on the registry key.
Detects successful logon attempts that occur via the Windows Management Instrumentation (WMI) service, specifically when the WmiPrvSE.exe process is involved. This can indicate an adversary using WMI for execution or lateral movement.
Detects obfuscated PowerShell commands being executed via standard input (stdin) by monitoring Windows Security Event ID 4697. The rule looks for specific keywords like 'set', '&&', 'environment', 'invoke', and '${input)' within the ServiceFileName field, which can indicate attempts to bypass detection by passing obfuscated scripts or commands directly to PowerShell.
Page 502 of 680