SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,666 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects a failed logon attempt from a public IP address on a Windows system. This can indicate an attempt to gain unauthorized access, potentially through brute-force attacks or credential stuffing, especially if the system is not intended to be exposed to the internet for direct login.
This rule detects attempts to backdoor a domain object by granting DCSync rights to a regular user or machine account. This is achieved by modifying the 'ntSecurityDescriptor' attribute in Active Directory, specifically looking for GUIDs associated with DCSync extended rights. Such a modification allows the designated account to perform DCSync attacks, enabling the retrieval of password hashes for any user or computer in the domain.
Detects unusual processes accessing 'desktop.ini' remotely over a network share with write permissions. This activity can be leveraged to alter how Windows Explorer displays a folder's content (e.g., renaming files) without actually changing the files on disk, which can be used for persistence or privilege escalation.
Detects the creation or modification of a computer account or user account with a suspicious name pattern 'SAMTHEADMIN-X$' (where X is a number) which is known to be generated by a hacktool exploiting CVE-2021-42287 and CVE-2021-42278. This pattern is associated with the 'Sam the Admin' vulnerability exploitation.
This rule detects uncommon outbound network connections on TCP port 88, which is the default port for Kerberos. Such activity, especially from processes other than expected system services like LSASS or common applications like web browsers and Tomcat, can indicate potential lateral movement or initial privilege escalation attempts through Kerberos delegation. Attackers often leverage Kerberos for authentication in Windows environments to move between systems or elevate privileges, for example, using tools like Rubeus for Kerberoasting or other Kerberos-based attacks.
Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324, potentially leading to webshell deployment.
This rule detects connection attempts to the SSH service running on an OpenCanary honeypot node. OpenCanary is a honeypot designed to attract and detect unauthorized access attempts. A connection attempt to an SSH service on an OpenCanary instance indicates potential reconnaissance or attack activity against the honeypot, which should be investigated as it suggests an adversary is probing for vulnerable services.
This rule detects the addition of a new conditional access policy within an Azure environment. Conditional Access policies are critical security controls that determine when and how users can access resources. Unauthorized or unexpected changes to these policies could indicate an attacker attempting to establish persistence, bypass existing security controls (like MFA), or gain unauthorized access by modifying access conditions.
Detects the use of 'at' or 'atd' utilities, which are commonly abused by adversaries for persistence or to schedule the execution of malicious code. This rule specifically looks for the execution of '/at' or '/atd' binaries.
Detects instances where an SSH service on an OpenCanary honeypot node has had a login attempt. This indicates an adversary attempting to gain unauthorized access to a system, likely through brute-force or credential stuffing attacks against the honeypot.
Page 201 of 680