SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the creation of shadow copies using operating system utilities such as PowerShell, WMIC, or VSSAdmin. Adversaries often create shadow copies to access credential material, specifically the NTDS.dit file or SAM database, for offline analysis. The rule looks for specific executable names combined with command-line arguments containing 'shadow' and 'create'.
Detects a suspicious process command line where 'whoami' is used as the first parameter, which can be indicative of privilege escalation techniques like those used by EfsPotato. This rule specifically looks for '.exe whoami' in the command line.
Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.
Detects the execution of various scripting interpreters or command-line tools via a LNK file accessed from a WebDAV share. This technique is often used by adversaries to bypass security controls and execute malicious code, leveraging the `DavWWWRoot` path to indicate WebDAV access. The parent process is expected to be `explorer.exe`, suggesting user interaction.
Detects the use of wmic.exe to enumerate service properties (name, displayname, pathname, startmode) which is a common reconnaissance technique used by attackers and pentesters to identify unquoted service paths for potential privilege escalation.
Detects changes to the Windows Registry that configure a monitor program to dump the memory of the lsass.exe process using the SilentProcessExit technique. This method leverages Image File Execution Options (IFEO) to trigger a memory dump of LSASS when it exits, which can be used to extract credentials.
Detects the abuse of the 'exefile' handler in new file associations within the Windows Registry. This technique can be used by adversaries to bypass security products by associating a malicious executable with a common file extension, causing the malicious executable to run when a user interacts with that file type.
Detects potential persistence by monitoring for modifications to the Excel Options registry key, specifically looking for the addition of an Excel Add-in (XLL) file that would cause it to run automatically when Excel starts. This technique is often used by adversaries to maintain access to a compromised system.
This rule detects error messages generated by Sysmon when it fails to open its service configuration or connect to its driver to update the configuration. These errors can indicate an adversary's attempt to tamper with or disable Sysmon logging to evade detection. The rule specifically filters out known false positives related to write-protected media or specific error codes (19, 93) to reduce noise.
Detects when an attacker attempts to disable or modify Sysmon's configuration to evade detection. This rule specifically looks for Sysmon's state changing to 'Stopped' or a 'Sysmon config state changed' event occurring when Sysmon was not already in a 'Started' state.
Page 535 of 680