SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,526 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects loading of essential DLLs used by PowerShell by non-PowerShell process.
Detects behavior similar to meterpreter's "load powershell" extension.
Detects behavior similar to meterpreter's "load powershell" extension.
Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application.
This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function
This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function
Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.).
It is highly recommended to perform an initial baseline before using this rule in production.
It is highly recommended to perform an initial baseline before using this rule in production.
Detects suspicious processes based on name and location that access the windows credential manager and vault.
Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function
Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function
Detects rundll32 execution where the DLL is located on a remote location (share)
Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages
Detects certain command line parameters often used during reconnaissance activity via web shells
Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method.
Event 5858 in the WMI-Activity operational log is an error event, meaning it is only generated
when the WMI operation encounters an error (e.g. access denied, provider failure).
It could be an indication of an attacker attempting to clear event logs via WMI, but failing due to insufficient privileges or other issues.
Successful clearing operations will NOT produce this event; for those, correlate with
Security event 1102 or System event 104.
Event 5858 in the WMI-Activity operational log is an error event, meaning it is only generated
when the WMI operation encounters an error (e.g. access denied, provider failure).
It could be an indication of an attacker attempting to clear event logs via WMI, but failing due to insufficient privileges or other issues.
Successful clearing operations will NOT produce this event; for those, correlate with
Security event 1102 or System event 104.
Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).
Page 15 of 680