SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,654 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects activities performed by the AWS root account. The root account has unrestricted access to all resources in an AWS account, making its usage a critical security event that often indicates a potential compromise, misconfiguration, or a highly privileged operation that should be closely monitored. The rule specifically looks for events where the 'userIdentity.type' is 'Root' and excludes 'AwsServiceEvent' to filter out automated AWS service activities that might legitimately use root permissions internally.
This rule detects the modification of the Windows Registry to install or configure Chrome VPN extensions. Specifically, it looks for changes to the 'Software\Wow6432Node\Google\Chrome\Extensions' registry path where the 'update_url' value is set for a known list of VPN extension IDs. This method can be used by adversaries to establish persistence or gain initial access by forcing the installation of malicious or controlled VPN extensions.
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by looking for process access that involves legitimate Windows executables (iediagcmd.exe, CustomShellHost.exe) accessing suspicious executables hosted on WebDAV shares. This indicates an attacker may be exploiting Process.Start() search order manipulation to execute malicious code from attacker-controlled WebDAV servers instead of legitimate system binaries. The vulnerability allows unauthorized code execution through external control of file names or paths via WebDAV.
This rule detects the creation or modification of cron files or files within standard cron directories on Linux systems. Adversaries often abuse the cron utility to establish persistence or schedule malicious tasks for execution at specific times or intervals. Monitoring these file events can help identify unauthorized scheduling of tasks.
Detects potential exploitation of the PwnKit vulnerability (CVE-2021-4034) by looking for specific keywords in authentication logs. The rule identifies attempts to execute 'pkexec' with suspicious environment variable content and specific user/TTY information, indicative of a local privilege escalation attempt.
This rule detects the execution of 'GUP.exe' (Notepad++ updater) from any directory other than its legitimate installation paths within 'Program Files' or user-specific 'AppData' folders. This behavior is often indicative of DLL side-loading attacks where a malicious GUP.exe might be placed in a controlled directory to load a malicious DLL.
This rule detects when a user successfully elevates their permissions to manage all Azure Subscriptions. This action grants broad access across the Azure environment and should be immediately investigated if it is not a planned administrative activity. Such an elevation could be leveraged by an attacker to gain extensive control over Azure resources.
Detects the creation of a new user account with privileged User ID (UID) or Group ID (GID) on Linux systems, specifically targeting root (UID=0, GID=0), wheel (GID=10), or sudo (GID=27) groups. This rule monitors logs for `useradd` events indicating the creation of users with these elevated privileges.
Detects the execution of SharpUp, a tool used for local privilege escalation. The rule specifically looks for the executable name 'SharpUp.exe' or the description 'SharpUp', combined with command-line arguments indicative of its privilege escalation enumeration capabilities, such as 'HijackablePaths', 'UnquotedServicePath', 'ProcessDLLHijack', 'ModifiableServiceBinaries', 'ModifiableScheduledTask', 'DomainGPPPassword', and 'CachedGPPPassword'.
Detects the installation of the Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.
Page 189 of 680