SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,506 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of a new user profile in the Windows Registry with specific usernames ('ANONYMOUS' or '_DomainUser_') within the ProfileList, which has been observed in some variants of the COLDSTEEL RAT malware. This indicates potential persistence or privilege escalation attempts by creating a new user account.
Detects Rorschach ransomware execution activity by looking for specific system utilities being executed with a distinct command-line string ('11111111'). The utilities include bcdedit.exe, net.exe, net1.exe, netsh.exe, wevtutil.exe, and vssadmin.exe, which are commonly abused by ransomware for defense evasion, system modification, and data destruction.
Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software. This rule specifically looks for the 'update.exe' process within the 3CXDesktopApp directory being executed with command-line arguments indicating an update operation for version '18.12' via HTTP, which was associated with the supply chain compromise.
Detects the creation of a remote thread from a PowerShell process (powershell.exe or pwsh.exe) into another process. This activity can be indicative of process injection techniques used by adversaries to execute malicious code or evade defenses. A filter is included to exclude known legitimate activity from CompatTelRunner.exe.
Detects Microsoft Excel loading an Add-In (.xll) file. Adversaries may use malicious Excel Add-Ins to execute arbitrary code, establish persistence, or perform other malicious activities. This rule specifically looks for the loading of '.xll' files by 'excel.exe'.
Detects the execution of PowerShell cmdlets 'Get-NetFirewallRule' or 'Show-NetFirewallRule' to enumerate local firewall rules on a host. This activity is often performed by adversaries during the discovery phase to understand network configurations and potential egress/ingress points.
Detects the use of 'curl.exe' to download files by looking for specific command-line arguments such as '-O', '--remote-name', or '--output'. This activity can indicate an adversary transferring tools or other files into a compromised environment.
This rule detects the execution of 'net.exe' or 'net1.exe' with the command-line argument '/TRANSPORT:QUIC'. This combination indicates an attempt to mount Windows SMB shares over QUIC, which might be an unusual or unexpected activity in many enterprise environments. Adversaries could leverage this for lateral movement or data access.
Identifies when a Point-to-site VPN is Modified or Deleted in Azure. This could indicate an attacker attempting to disrupt network access or cover their tracks by removing or altering VPN configurations.
Detects when an administrator grants an application either application permissions (app roles) or highly privileged delegated permissions within an Azure environment. This action is logged in the Azure audit logs as 'Add app role assignment to service principal'. Such assignments can lead to persistence or privilege escalation if abused.
Page 511 of 680