SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,671 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule identifies the suspicious use of the AWS Security Token Service (STS) API call `GetSessionToken`. This API call is used to request temporary, limited-privilege credentials for an IAM user or role. Attackers may use `GetSessionToken` to generate temporary tokens to move laterally within an AWS environment or escalate privileges by assuming roles with broader permissions. The rule specifically looks for `GetSessionToken` calls made by an `IAMUser`.
Detects the addition of a new root certificate authority to an Azure AD tenant. This action can be performed by an attacker to establish persistence and enable certificate-based authentication for unauthorized access, potentially bypassing traditional password-based authentication mechanisms. This is a critical security event as it can lead to privilege escalation and persistent access within the Azure AD environment.
Detects when users successfully authenticate to Azure AD using only single-factor authentication, indicating that MFA was not required or was bypassed. This could be due to misconfiguration, an attacker bypassing MFA, or legitimate exceptions.
Detects the use of the `mknod` syscall to create special files (e.g., character or block devices) on Linux systems. This syscall is rarely used by legitimate applications and can be abused by attackers or malware to create fake devices, interact with kernel interfaces, establish covert channels, bypass file system restrictions, or create backdoors.
This rule detects the installation of a new service that exhibits characteristics commonly associated with the Meterpreter or Cobalt Strike 'getsystem' command. Specifically, it looks for Event ID 4697 (A service was installed in the system) and then analyzes the 'ServiceFileName' for patterns indicative of these tools. It identifies two main techniques: one involving 'cmd.exe' or '%COMSPEC%' echoing data to a named pipe (e.g., `echo 559891bb017 > \\.\pipe\5e120a`), and another involving 'rundll32.exe' loading a DLL with specific arguments (e.g., `rundll32.exe C:\Users\test\AppData\Local\Temp\tmexsn.dll,a /p:tmexsn`). Additionally, it flags service installations where the 'ServiceFileName' starts with a specific network share path (`\\127.0.0.1\ADMIN$\`). These methods are typically used by adversaries to escalate privileges to SYSTEM.
Detects the loading of the WinDivert driver, which is a powerful user-mode package for Windows capable of capturing, sniffing, modifying, blocking, and re-injecting network traffic. This driver can be used by adversaries for network sniffing, credential access, and defense evasion techniques.
Detects attempts to create a DLL file in known desktop application dependencies folders (e.g., Slack, Teams, OneDrive) by an unusual process. This activity may indicate an adversary attempting to load a malicious module via DLL search order hijacking for persistence, privilege escalation, or defense evasion.
Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.
Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location
Detects specific registry markers associated with the FlowCloud malware, which is known to be used by the threat group TA410. The rule identifies unique registry paths where FlowCloud stores its configuration and drivers for its keylogger components.
Page 205 of 680