SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,674 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects command line parameters used by ADCSPwn, a tool designed to escalate privileges in an Active Directory network. This tool achieves privilege escalation by coercing authentication from machine accounts and relaying it to the certificate service.
Detects the presence of a base64-encoded signature ("UWhRC....AAYBAAAA") in the command line, which corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. This pattern is a strong indicator of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests, potentially exploiting vulnerabilities like CVE-2025-33073. The rule aims to identify attempts to add spoofed SPNs to DNS records or check for their presence using commands like `nslookup`.
Detects when an attacker attempts to modify an existing scheduled task to execute a payload from suspicious locations. This technique allows attackers to bypass detection mechanisms that primarily focus on the creation of new scheduled tasks, by instead altering a legitimate task to include their malicious code.
Detects the use of the 'EnableRegion' command in AWS CloudTrail logs. This command allows an AWS account to enable additional regions. Monitoring this activity is crucial because adversaries might enable new, less-monitored regions to establish persistence, exfiltrate data, or conduct other malicious activities, potentially bypassing existing security controls that are not configured for these new regions.
Detects global permissions change activity.
Detects when a new member is added or invited to a github organization.
Detects access to Okta admin functions through proxy.
Detects when an user assumed another user account.
This rule detects the installation of a Windows service named 'NtsSrv' with an ImagePath ending in ' LocalService'. This specific service name and image path pattern are associated with the StoneDrill wiper malware, as described in Kaspersky's research.
Detects the deactivation or disabling of the Windows Scheduled Defragmentation task, which has been observed as a tactic used by the Slingshot APT group to hinder forensic analysis or system maintenance.
Page 210 of 680