SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,675 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects activity associated with the APT31 (ZIRCONIUM) threat group, specifically focusing on credential dumping using ldifde, lateral movement attempts involving copying tools like procdump64.exe, netsess.exe, and 7za.exe to remote shares, and archiving data. This rule is based on observations described in the Crowdstrike 2019 Global Threat Report.
Detects suspicious VBScript execution patterns, specifically looking for a combination of keywords often used by UNC2452 (NOBELIUM) in their malware. The rule identifies command lines containing 'Execute', 'CreateObject', 'RegRead', 'window.close', and '\Microsoft\Windows\CurrentVersion', while filtering out common legitimate uses involving the 'Run' registry key path to reduce false positives.
This rule detects the execution of the extended stored procedure backdoor named Maggie in the context of Microsoft SQL server by looking for specific event IDs and the string 'maggie' in the event message.
Detects exploitation attempts of CVE-2024-50623 in Cleo software by identifying `cmd.exe` processes spawned from `javaw.exe` (associated with Cleo applications like Harmony, Lexicom, VersaLex, or VLTrader) that execute PowerShell commands with suspicious arguments indicative of encoded commands or web downloads.
Detects the invocation of PowerShell commands that reference classes from the "System.Security.Cryptography" namespace. This namespace provides classes for on-the-fly encryption and decryption, which can be abused by adversaries for defense evasion, such as decrypting malicious payloads.
This rule detects remote procedure calls (RPC) to modify the Windows Registry, which can be indicative of lateral movement or persistence mechanisms. Specifically, it monitors for RPC Firewall events with EventID 3 and an InterfaceUuid corresponding to the Remote Registry Protocol (338cd001-2244-31f1-aaaa-900038001003), focusing on specific operation numbers (OpNum) that represent various registry modification functions. This activity could be used by attackers to establish persistence, evade defenses, or execute code remotely.
This rule detects remote procedure call (RPC) activity related to the creation or execution of scheduled tasks using the SASec interface. Specifically, it looks for Event ID 3 from the RPC Firewall log source, where the InterfaceUuid matches '378e52b0-c0a9-11cf-822d-00aa0051e40f' (which corresponds to the Task Scheduler service) and the OpNum is either 0 (SchRpcRegisterTask) or 1 (SchRpcRunTask). This indicates an attempt to remotely register or run a scheduled task, which can be a method for lateral movement, execution, or persistence by adversaries.
Detects the S3 Browser utility performing reconnaissance by checking for existing AWS IAM Users without a LoginProfile defined, and subsequently creating a LoginProfile if one is not found. This behavior has been associated with the Guivil threat actor.
Detects when an account that has been disabled or blocked attempts to sign in. This could indicate an attacker attempting to use compromised credentials for an account that is no longer active or has been locked out due to suspicious activity.
Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.
Page 211 of 680