SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,664 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation or modification of local user accounts and changes to remote authentication configurations on Cisco devices. It specifically looks for keywords 'username' and 'aaa' in Cisco AAA logs, indicating actions related to account management or authentication settings.
Detects attempts to load drivers that have been revoked by Microsoft, as indicated by EventID 3023 in the CodeIntegrity-Operational log. This event signifies that the Windows Code Integrity component has blocked a driver from loading due to its revoked certificate status, which is a critical security measure to prevent malicious or vulnerable drivers from executing on the system.
Detects unexpected file modifications by 'dns.exe', which could indicate remote code execution or other exploitation, specifically referencing CVE-2020-1350 (SigRed). The rule filters out modifications to 'dns.log' to reduce false positives.
This rule detects the creation or registration of scheduled tasks using PowerShell cmdlets or WMI methods. It specifically looks for the use of `New-ScheduledTaskAction`, `New-ScheduledTaskTrigger`, `New-ScheduledTaskPrincipal`, `New-ScheduledTaskSettingsSet`, `New-ScheduledTask`, `Register-ScheduledTask` cmdlets, or the `Invoke-CimMethod` cmdlet targeting the `PS_ScheduledTask` class within the `Root\Microsoft\Windows\TaskScheduler` namespace. This activity is often abused by adversaries for persistence, privilege escalation, and execution.
Detects the execution of various compiled Windows binaries from the Impacket toolset. This rule identifies the tools based on their filenames or partial filenames, which could lead to false positives due to legitimate software having similar names or adversaries renaming the tools. Impacket is a collection of Python classes for working with network protocols, often used by adversaries for lateral movement, credential access, and execution.
This rule detects the creation of a child process with SYSTEM privileges where the parent process was running under a LOCAL SERVICE or NETWORK SERVICE account. This behavior is often indicative of privilege escalation techniques such as Rotten Potato or RogueWinRM, which exploit vulnerabilities to elevate privileges from service accounts to SYSTEM.
Detects the creation of WMI event subscriptions, which can be used as a persistence mechanism by adversaries. This rule specifically looks for Sysmon Event IDs 19 (WmiEventFilter activity), 20 (WmiEventConsumer activity), and 21 (WmiEventConsumerToFilter activity), indicating the creation or modification of WMI event filters, consumers, or their binding.
Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts.
Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path. This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this legitimate Notepad++ installer. The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Page 198 of 680