SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,506 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory, which is a common technique used by attackers to steal credentials. The detection is specifically triggered by Windows Defender's Attack Surface Reduction (ASR) rule for blocking credential stealing from LSASS, indicated by EventID 1121 and the target path ending with '\lsass.exe'. The rule includes filters to reduce false positives from legitimate processes that might interact with LSASS.
Detects when Microsoft Defender for Endpoint blocks process creations originating from PSExec or WMI commands. This rule specifically looks for Event ID 1121 (Attack Surface Reduction rule blocked action) where the process name ends with 'wmiprvse.exe' (WMI Provider Host) or 'psexesvc.exe' (PsExec service). This indicates that an ASR rule designed to prevent execution via these methods has been triggered and successfully blocked the action.
Detects when the Windows Defender antivirus scanning feature is disabled, indicated by Event ID 5012 from the WinDefend service. This action is often performed by adversaries to impair defenses and avoid detection.
Detects DNS queries initiated by 'Regsvr32.exe'. This activity is suspicious as 'Regsvr32.exe' is a legitimate Windows utility used to register and unregister DLLs, but it is often abused by adversaries for proxy execution, defense evasion, and bypassing application control. A DNS query from this process could indicate an attempt to resolve a malicious domain for command and control or payload retrieval.
This rule detects the deletion of Windows Event Log (EVTX) files. Adversaries often delete these logs to remove forensic evidence of their activities, making it harder for defenders to investigate and understand the scope of a compromise. The rule specifically looks for file deletion events where the target filename starts with 'C:\Windows\System32\winevt\Logs\' and ends with '.evtx', which are the standard locations and extensions for Windows Event Log files.
This rule detects the deletion of PowerShell console history logs, specifically the 'ConsoleHost_history.txt' file located within the 'PSReadLine' directory. Adversaries often delete these logs to remove forensic evidence of their commands and activities, making it harder for defenders to trace their actions and understand the scope of a compromise. This action is a common defense evasion technique.
Detects the creation of the default CSExec service executable file, 'csexecsvc.exe', which indicates the installation and potential execution of the CSExec service. CSExec is a tool similar to PsExec, used for remote command execution.
This rule detects the creation of '.cmdline' files, which are artifacts generated during dynamic C# compilation. Adversaries may use dynamic C# compilation to unpack and execute payloads without writing the compiled executable to disk, making it a defense evasion technique. The rule specifically looks for the creation of these files as an indicator of such activity, particularly when initiated by processes not typically associated with C# compilation.
This rule detects the creation of files with specific naming conventions that are indicative of tools exploiting the HiveNightmare (CVE-2021-36934) vulnerability to export the Security Account Manager (SAM) database. The rule looks for various file names and patterns used by different implementations of HiveNightmare exploitation tools, including those written in Go, C++, PowerShell, and C#.
Detects the creation of a file named 'debug.bin' in the '\Temp\' directory, which is the default output filename used by the SafetyKatz tool for dumping LSASS memory. This activity is indicative of an attempt to extract credentials from the Local Security Authority Subsystem Service (LSASS) process.
Page 514 of 680