SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,672 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of 'at' or 'atd' utilities, which are commonly abused by adversaries for persistence or to schedule the execution of malicious code. This rule specifically looks for the execution of '/at' or '/atd' binaries.
Detects instances where an SSH service on an OpenCanary honeypot node has had a login attempt. This indicates an adversary attempting to gain unauthorized access to a system, likely through brute-force or credential stuffing attacks against the honeypot.
This rule detects the creation of AWS API keys for a user by a different user. This activity is indicative of a backdoored user account being used to establish persistence within an AWS environment. It can also help identify unusual flows of AWS key creation within an organization.
This rule detects anomalous user activity patterns, specifically focusing on suspicious changes to directories or other behaviors that Microsoft Entra ID Protection identifies as 'anomalousUserActivity'. This could indicate compromised accounts or insider threats.
Detects when a Google Workspace user is granted administrative privileges. This could indicate a legitimate administrative action or a malicious attempt to escalate privileges within the Google Workspace environment.
Detects the start or reload of a service on Linux systems using 'systemctl' or 'service' commands. This can be indicative of persistence mechanisms or privilege escalation attempts where adversaries modify or create services to execute malicious payloads.
Detects attempts to enable the root account on macOS systems using the 'dsenableroot' command-line utility. This action can be used for persistence, privilege escalation, or defense evasion by adversaries.
Detects the execution of the hacktool Rubeus using specific command line flags within PowerShell script block logs. This rule identifies various Kerberos-related attacks such as AS-REPRoasting, Kerberoasting, Pass-the-Ticket, Golden Ticket, and Silver Ticket attacks, as well as credential harvesting and dumping.
This rule detects modifications to specific registry keys related to shell open commands for 'ms-settings' and 'exefile'. These modifications are commonly used for persistence and UAC bypass techniques, particularly those leveraging tools like UACMe and targeting executables such as fodhelper.exe, computerdefaults.exe, and slui.exe. The rule looks for changes to 'SymbolicLinkValue', 'DelegateExecute', and '(Default)' values within these registry paths, while filtering out empty default values.
This rule detects attempts to bypass User Account Control (UAC) by modifying the Windows Registry related to the 'mscfile' handler. Specifically, it looks for changes to the default command associated with '.msc' files, which can be abused by 'eventvwr.exe' to execute arbitrary code with elevated privileges without a UAC prompt. The filter excludes legitimate modifications where the 'Details' field starts with '%SystemRoot%\system32\mmc.exe "%1" %', aiming to reduce false positives from standard system operations.
Page 202 of 680