SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,659 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects when a ClickOnce application loads an unsigned or expired-signature module. ClickOnce applications are typically found in the `\AppData\Local\Apps\2.0\` directory. The detection specifically looks for image load events where the image path matches this ClickOnce application directory pattern and the loaded module's signature status is either 'false' (unsigned) or 'Expired'. This behavior can be indicative of an adversary abusing ClickOnce for trusted code execution, potentially for privilege escalation, defense evasion, or persistence, by injecting or replacing modules with malicious unsigned ones.
Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" via command line, which can be used for persistence.
Detects the modification of the Outlook setting "LoadMacroProviderOnBoot" to enable the automatic loading of any configured VBA project/module, which can be abused for persistence.
Detects the installation of new shim databases that attempt to patch sections of known processes for potential process injection or persistence. This rule specifically looks for modifications to the AppCompatFlags\Custom registry key where shims are typically registered, targeting common system processes.
Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services. If not legitimately used in the enterprise environment, its presence may indicate malicious activity.
Detects the deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog. Adversaries may delete this key to cover their tracks after executing commands, particularly in techniques like those used in clickfix where phishing lures instruct users to execute malicious commands via the Run dialog.
Detects potential Ryuk ransomware activity by looking for specific command-line patterns. This includes attempts to establish persistence via the Run registry key, deletion of backup files, and stopping critical services using 'net stop' commands.
This rule detects persistence mechanisms used by the Kapeka backdoor. It specifically looks for the creation of a scheduled task named "Sens Api" (or "OneDrive" in some cases) via `schtasks.exe` set to run on system startup, or the addition of an autorun registry entry named "Sens Api" under `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` via `reg.exe`. Both persistence methods are identified by their command lines calling `rundll32` with a `.wll` file and the export ordinal `#1`.
This rule identifies a critical security misconfiguration or bypass scenario within Azure Privileged Identity Management (PIM) where a privileged role can be activated without requiring multi-factor authentication (MFA). This can significantly increase the risk of unauthorized access and privilege escalation if an attacker compromises credentials for an account with PIM roles.
This rule detects instances where a user denies a multi-factor authentication (MFA) prompt. This could indicate that an attacker has successfully obtained the user's password and is attempting to gain unauthorized access, prompting the legitimate user for MFA approval. The user's denial signals that they did not initiate the login attempt.
Page 196 of 680