SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,625 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities
Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities
Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system.
These files include, but are not limited to, system configuration files, authentication files, and critical application files.
Attackers often target these files to maintain persistence, escalate privileges, or disrupt system operations.
These files include, but are not limited to, system configuration files, authentication files, and critical application files.
Attackers often target these files to maintain persistence, escalate privileges, or disrupt system operations.
Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker.
Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files.
This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job.
Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes.
Additionally, it is recommended to review the contents of the newly created cron files to assess their intent.
Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment.
Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files.
This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job.
Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes.
Additionally, it is recommended to review the contents of the newly created cron files to assess their intent.
Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment.
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.
Detects execution of MemProcFS a memory forensics tool with the '-device' parameter.
MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.
MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.
Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence
Detects when a API token is created
Page 152 of 680