SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,659 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
This rule detects the execution of tools designed for Parent Process ID (PPID) spoofing, specifically targeting Didier Stevens' 'SelectMyParent' tool. It identifies these tools through their executable name, specific command-line arguments, original file names, and known IMPHASH values. PPID spoofing is a defense evasion technique where a new process is created with a manipulated parent process ID to obscure its true origin, often to bypass security monitoring or elevate privileges.
Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks. Specifically, it looks for Velociraptor spawning 'code.exe' with tunneling arguments, 'msiexec' with '/i' and 'http' for remote installation, or PowerShell/pwsh executing web requests or file downloads.
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 which involves unauthorized code execution via WebDAV through external control of file names or paths. The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe by manipulating their working directories to point to attacker-controlled WebDAV servers, causing them to execute malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries through Process.Start() search order manipulation.
Detects modifications to critical Unix shell configuration files. Adversaries may modify these files to establish persistence or elevate privileges by executing malicious commands when a new shell is opened or a user logs in.
This rule detects the creation or modification of a specific registry run key used by the Leviathan APT group for persistence. The key path observed is '\Software\Microsoft\Windows\CurrentVersion\Run\ntkd'. This indicates that a program named 'ntkd' is configured to execute automatically when a user logs in, a common technique for maintaining access to a compromised system.
Detects potential suspicious behavior using secedit.exe, specifically when it is used to export or configure security policies. This could indicate an adversary attempting to discover system configurations or modify them for persistence, defense evasion, or privilege escalation.
Detects successful sign-ins by privileged role accounts that occur outside of normal business hours or from unusual geographic locations. This rule is designed to flag potentially suspicious activity that could indicate compromised credentials or insider threat activity, especially for administrative accounts.
Detects the loading of the "taskschd.dll" module from a process that is located in a potentially suspicious or uncommon directory. The loading of this DLL might indicate that the application has the capability to create a scheduled task via the "Schedule.Service" COM object. Investigation of the loading application and its behavior is required to determine if it is malicious.
Identifies when a user grants permissions to another user on Azure resources. The rule specifically looks for the 'Microsoft.Authorization/roleAssignments/write' operation in Azure Activity Logs, which indicates a role assignment creation or modification. This can be an indicator of privilege escalation or persistence.
Page 194 of 680