SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,654 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when an instance identity has taken an action that isn't inside SSM.
This can indicate that a compromised EC2 instance is being used as a pivot point.
This can indicate that a compromised EC2 instance is being used as a pivot point.
Detects successful authentication attempts originating from clients using legacy authentication methods, identifiable via specific user agent strings. This activity can indicate an adversary attempting to bypass multi-factor authentication (MFA), potentially as part of a password spray attack. Legacy authentication protocols often do not support modern MFA mechanisms, making them a target for attackers who have obtained valid credentials through other means or are performing brute-force attacks like password spraying.
Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.
Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog. Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys. Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.
Detects the execution of TruffleHog, a tool designed to search for secrets across various platforms such as Git, Jira, Slack, and SharePoint. While TruffleHog is a legitimate tool often used in CI pipelines and security assessments, its execution can also indicate malicious activity, as observed in campaigns like Shai-Hulud targeting npm packages to steal sensitive information. The rule triggers on the execution of 'trufflehog.exe' or when its command line arguments indicate searching specific platforms or verifying results.
This rule detects attempts to abuse Azure Browser Single Sign-On (SSO) by monitoring for the loading of the 'MicrosoftAccountTokenProvider.dll' library. This DLL is involved in requesting OAuth 2.0 refresh tokens for Azure AD-authenticated Windows users on Azure AD-joined machines, enabling SSO in browsers. An attacker could leverage this to authenticate to Azure AD as the compromised user within a browser. The rule filters out legitimate loads by common processes like BackgroundTaskHost.exe, Visual Studio (devenv.exe), Internet Explorer (iexplore.exe), Microsoft Edge (msedge.exe, msedgewebview2.exe), and OneDrive (OneDrive.exe) to reduce false positives.
Detects suspicious modification of the crontab file, which can be used by adversaries for persistence, privilege escalation, or execution of malicious code on Unix-like systems. The rule specifically looks for the 'REPLACE' keyword in cron logs, indicating a crontab entry has been changed.
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith. The rule specifically looks for 'UserLoggedIn' operations with 'Success' status for the Microsoft Intune Company Portal ApplicationId, while excluding a specific ObjectId often associated with mobile device enrollment to reduce false positives.
Detects the attack technique pass the hash which is used to move laterally inside the network
Detects when Microsoft Cloud App Security (MCAS) reports a risky sign-in attempt due to an impossible travel scenario. This indicates a potential compromise of user credentials where an attacker logs in from a geographically distant location in a short timeframe, making physical travel impossible.
Page 188 of 680