SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,664 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects remote RPC calls to create or execute a scheduled task via the Advanced Telephony Service (ATSvc) interface. This activity can be indicative of lateral movement, privilege escalation, or persistence mechanisms used by adversaries.
Detects the deletion of an AWS SAML provider, which could indicate an attacker attempting to disrupt administrative or security team access. By removing the SAML provider, an adversary can hinder the ability of security personnel or system administrators to investigate and respond during an attack.
This rule identifies when a user or application modifies the federation settings on a domain within Azure Active Directory. Such modifications can impact how users authenticate and can be leveraged by attackers for persistence, privilege escalation, or defense evasion by altering trust relationships.
Detects when changes are made to Privileged Identity Management (PIM) role settings within Azure Active Directory. This could indicate an attempt to alter how privileged roles are managed, potentially to facilitate unauthorized access or persistence.
This rule identifies when a privileged role assignment occurs in Azure Active Directory (now Microsoft Entra ID) without utilizing Privileged Identity Management (PIM). Such assignments bypass the just-in-time access and approval workflows provided by PIM, potentially indicating an attacker attempting to establish persistent privileged access or escalate privileges outside of established security controls.
Detects the deployment of container workloads in Google Cloud Platform (GCP) that utilize the 'break-glass' flag to bypass Binary Authorization controls. This indicates an intentional override of security policies designed to ensure only trusted images are deployed, potentially allowing unauthorized or malicious container images to run.
Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command. This technique leverages the /proc filesystem to modify a running process's memory, which can be used for privilege escalation or defense evasion.
This rule detects attempts to enable the guest account on macOS systems using the `sysadminctl` utility. Adversaries may enable the guest account to establish persistence, evade defenses, or gain initial access by leveraging a default, often less monitored, account.
This rule detects logon events (EventID 4624) with LogonType 3 (network logon) where the TargetUserName is 'ANONYMOUS LOGON' and the WorkstationName is '-' (indicating a local system or unknown workstation). Additionally, the source IP address must be a loopback address ('127.0.0.1' or '::1'). This specific combination of characteristics is indicative of a RottenPotato-like attack pattern, which exploits local NTLM relay vulnerabilities to escalate privileges.
Page 199 of 680