SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,676 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects specific DCE-RPC function calls that are indicative of persistence techniques on a remote Windows system. The detected operations include adding print monitors or print processors, and creating processes with logon credentials, which can be abused by adversaries to maintain access or execute code.
This rule detects the use of the hacktool Ruler by Sensepost, specifically looking for 'RULER' in the Workstation or WorkstationName fields of Windows Security Event IDs 4776 (Credential Validation) and 4624/4625 (Logon/Logoff). Ruler is a tool designed to abuse Microsoft Exchange services.
Detects non-system users performing privileged operations on the Service Control Manager (SCM) database, specifically taking ownership of the 'servicesactive' object. This could indicate an attempt to manipulate Windows services for privilege escalation or persistence.
This rule detects failed attempts by a user or process to call the 'LsaRegisterLogonProcess' function. This function requires the 'SeTcbPrivilege' privilege, which is typically held by legitimate logon processes. A failure to call this function, especially when combined with the '0x8010000000000000' keyword indicating a failure, could suggest an attacker (e.g., using tools like Rubeus) is attempting to interact with the Local Security Authority (LSA) to gain unauthorized access to credentials or perform other malicious activities. The rule specifically looks for Event ID 4673 (A privileged service was called) where the service is 'LsaRegisterLogonProcess()' and the operation failed.
Detects when a user account is added to the local 'Administrators' group on a Windows system. This activity is critical for privilege escalation and persistence, as it grants the added user administrative rights. While it can be a legitimate administrative action, it is also a common technique used by attackers to maintain control and elevate privileges after initial compromise.
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
Detects the creation of a new Windows service where the creating process has a Process ID (PID) of 0 or its parent process has a PID of 0. This is an unusual and suspicious behavior, as PID 0 is typically reserved for the System Idle Process or the System process itself, which should not be directly creating services. This could indicate a highly privileged process or kernel-level activity attempting to establish persistence or escalate privileges.
Detects remote thread creation initiated by specific scripting engines or Microsoft Office applications (cscript.exe, wscript.exe, mshta.exe, winword.exe, excel.exe) into processes within the SysWOW64 directory, where the start module is null. This behavior is characteristic of the CACTUSTORCH hack tool, which injects shellcode into legitimate processes to evade detection.
This rule detects the creation of an executable named 'Get-Variable.exe' within the 'Local\Microsoft\WindowsApps\' directory. This is a suspicious activity because 'Get-Variable' is a legitimate PowerShell cmdlet, not an executable. Adversaries can exploit the Windows application execution alias feature, where executables in the WindowsApps directory can be prioritized over PowerShell cmdlets with the same name. By placing a malicious 'Get-Variable.exe' in this path, an attacker can trick the system into executing their malicious binary instead of the intended PowerShell cmdlet when 'Get-Variable' is invoked, leading to persistence or privilege escalation.
This rule detects PowerShell scripts attempting to identify a virtualization or sandbox environment. It specifically looks for the use of WMI objects like 'MSAcpi_ThermalZoneTemperature' and 'Win32_ComputerSystem' in PowerShell script block text, which are commonly queried by malware to determine if it's running in a virtualized environment.
Page 209 of 680