SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,654 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading Windows system DLLs like gdi32.dll, netapi32.dll, etc.
This rule detects the creation of temporary files within the WebDAV TfsStore directory that have suspicious file extensions. Attackers can leverage WebDAV to force authentication or to drop malicious files onto a system. The presence of executable or archive file extensions in this specific temporary directory is highly indicative of malicious activity, potentially related to initial access or resource development.
This rule detects modifications to Active Directory user accounts that could enable an attacker to control another user's or computer's account without needing their credentials. Specifically, it looks for changes to attributes related to delegation, such as 'msDS-AllowedToDelegateTo' and 'msDS-AllowedToActOnBehalfOfOtherIdentity', or the 'servicePrincipalName' attribute for user objects, which can be abused for Kerberoasting or other delegation attacks. Event ID 4738 indicates a user account was changed, and Event ID 5136 indicates a directory service object was modified.
Detects the installation of services associated with various legitimate remote access tools. Threat actors commonly abuse these tools for persistence, privilege escalation, and remote control of compromised systems.
Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.
This rule detects PowerShell scripts attempting to perform keylogging. It specifically looks for the string 'Get-Keystrokes' which is often associated with keylogging scripts, or a combination of 'Get-ProcAddress user32.dll GetAsyncKeyState' and 'Get-ProcAddress user32.dll GetForegroundWindow' which are API calls commonly used in PowerShell keyloggers to capture keyboard input and determine the active window.
Detects potential malicious modification of the 'IsCredGuardEnabled' property value within the WDigest registry key to disable Credential Guard on a system. This action is often performed in conjunction with 'UseLogonCredential' to manipulate credential caching, potentially leading to credential dumping.
Detects AWS console logins from countries and IP addresses that are not recognized as legitimate for the organization. This alert can help identify potential unauthorized access attempts from unusual locations, which may indicate compromised credentials or malicious activity.
Detects known malicious service installations associated with Cobalt Strike beacons, often used for privilege escalation or lateral movement. The rule specifically looks for patterns in the ServiceFileName field of Windows Security Event ID 4697, such as the presence of 'ADMIN$' and '.exe', '%COMSPEC%', 'start', and 'powershell', or encoded PowerShell commands often used by Cobalt Strike.
This rule detects the execution of TruffleHog, a tool designed to find secrets in various platforms such as Git, GitHub, Jira, Slack, Confluence, SharePoint, Docker images, and cloud storage services like S3 and GCS. While TruffleHog is a legitimate tool often used in CI pipelines and security assessments, its execution can also indicate malicious activity, as observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information. The rule triggers on either the image name ending with '/trufflehog' or a combination of command-line arguments indicating its use to scan specific platforms and the '--results=verified' flag.
Page 190 of 680