SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,671 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the use of the PlistBuddy utility to modify LaunchAgents or LaunchDaemons on macOS. Specifically, it looks for command-line arguments that include 'RunAtLoad' and 'true', along with either 'LaunchAgents' or 'LaunchDaemons', indicating an attempt to establish persistence by configuring a program to run automatically at system startup or user login.
Detects attempts to create and add an account to the admin group via the `sysadminctl` utility on macOS. This action can be used for persistence, privilege escalation, or defense evasion by creating a new administrative user.
Detects network connections to the InterPlanetary File System (IPFS) where the URI contains a pattern indicative of an email address. This behavior is associated with recent phishing campaigns that leverage IPFS to host credential harvesting webpages, attempting to collect user credentials.
This rule detects when a new member is added to a security-enabled global group in a Windows environment. This activity is significant because adding users to such groups can grant them elevated privileges or access to sensitive resources, making it a common action for adversaries attempting privilege escalation or persistence.
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior, often associated with tools like Mimikatz's sekurlsa::pth module. This indicates an adversary is using stolen password hashes to authenticate to a system.
Detects the creation or modification of scheduled tasks via Group Policy Objects (GPO), which can be used by adversaries for persistence, execution, and lateral movement, often seen in ransomware deployment scenarios. The rule specifically looks for Event ID 5136 (Directory Service Changes) indicating modifications to GPO attributes related to machine or user extension names, and Event ID 5145 (Detailed File Share) indicating write access to ScheduledTasks.xml within the SYSVOL share.
Detects modifications to Group Policy Object (GPO) attributes, specifically 'gPCMachineExtensionNames', that are indicative of adding privileges to user accounts or adding users as local administrators. This is identified by the presence of specific GUIDs ('827D319E-6EAC-11D2-A4EA-00C04F79F83A' or '803E14A0-B4FB-11D0-A0D0-00A0C90F574B') within the 'AttributeValue' field of EventID 5136. These GUIDs are associated with Group Policy extensions that can be abused for privilege escalation.
Detects unusual processes accessing `desktop.ini` files. Adversaries can leverage `desktop.ini` to alter how Windows Explorer displays a folder's content (e.g., renaming files or changing icons) without modifying the actual files on disk. This can be used for persistence, privilege escalation, or to hide malicious files.
Detects the execution of the hacktool Rubeus via PE information or command line parameters. Rubeus is a C# toolset designed for raw Kerberos interaction, often used for credential access, Kerberoasting, and pass-the-ticket attacks.
Detects specific process creation patterns associated with the Winnti malware campaign targeting Hong Kong universities in late 2019 and early 2020. The rule looks for suspicious parent-child process relationships and specific file paths used by the malware, such as executables under 'C:\Windows\Temp', 'C:\ProgramData\DRM', and 'C:\ProgramData\DRM\CLR'. It also identifies instances where legitimate applications like 'wmplayer.exe' or 'SearchFilterHost.exe' are launched from these suspicious directories or by suspicious parent processes.
Page 204 of 680