SigmaHQ Detections
@sigmaHQ12 followers122,468 downloads2,593 copies16 likes160,483 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory
Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.
Detects the creation of a office macro file from a a suspicious process
Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.
Detects PowerShell creating a PowerShell file (.ps1). While often times this behavior is benign, sometimes it can be a sign of a dropper script trying to achieve persistence.
Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc.
Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShell\Modules\malware\malware.psm1". This is somewhat an uncommon practice as legitimate modules often includes a version folder.
Detects Rclone config files being created
Detects default RemCom service filename which indicates RemCom service installation and execution
Page 638 of 680