SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,654 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons
Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRS) and may indicate potential lateral movement activity. The rule specifically filters out 'conhost.exe' as a common benign child process.
Detects user sign-ins occurring outside of predefined normal business hours and from locations not explicitly whitelisted. This rule aims to identify potentially unauthorized access attempts or compromised accounts being used at unusual times or from unexpected geographies.
Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This behavior has been associated with exploitation of WinRAR path traversal vulnerabilities like CVE-2025-6218 or CVE-2025-8088.
This rule detects potential Pass the Hash (PtH) activity by monitoring Windows Security Event IDs 4624 (successful logon) and 4625 (failed logon) where the LogonType is 3 (Network) and the LogonProcessName is 'NtLmSsp'. It specifically filters out 'ANONYMOUS LOGON' to reduce false positives. This combination of events indicates an attempt to authenticate over the network using NTLM, which is characteristic of PtH attacks for lateral movement.
Detects potentially suspicious events involving "GetSigninToken" in AWS. An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credentials, which can help obfuscate the compromised AWS credential (the original access key) and enable pivoting from the AWS CLI to console sessions without requiring MFA, using the newly issued access key.
This rule detects when multi-factor authentication (MFA) has been explicitly disabled for a user in Azure Active Directory. This activity could indicate an adversary attempting to bypass authentication mechanisms to gain unauthorized access or maintain persistence.
Detects suspicious child processes spawned by 'SpeechRuntime.exe'. This activity is indicative of potential lateral movement attempts, specifically through COM & DCOM hijacking, where 'SpeechRuntime.exe' is abused as a proxy for execution.
Detects the possible addition of shadow credentials to an Active Directory object by monitoring for Event ID 5136 (Directory Service Changes) where the 'msDS-KeyCredentialLink' attribute is modified. This attribute is used in shadow credential attacks to establish persistence and gain unauthorized access.
Page 187 of 680