SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,678 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects attempts to exploit the sudo vulnerability CVE-2019-14287, which allows a user to run commands as root without authentication by specifying a user ID of -1 or 4294967295.
Detects suspicious changes to file privileges using `chown` to set ownership to root and `chmod` to enable setuid (u+s) or setgid (g+s) bits. This activity can be indicative of privilege escalation or persistence mechanisms where an adversary attempts to run code with elevated privileges.
This rule detects when a member is removed from a security-enabled global group in a Windows environment. This activity is captured by Event IDs 633 and 4729 in the Windows Security event log. Such an action could indicate an attempt to reduce an account's privileges, remove an adversary's access, or modify group memberships for other malicious purposes.
This rule detects attempts to downgrade NetNTLM security settings by monitoring modifications to specific registry keys related to LSA (Local Security Authority) configuration. Specifically, it looks for changes to 'LmCompatibilityLevel', 'NtlmMinClientSec', and 'RestrictSendingNTLMTraffic' within the 'SYSTEM\ControlSet\Control\Lsa' registry path. Such modifications can weaken NTLM authentication security, potentially enabling downgrade attacks where an attacker forces a less secure authentication protocol.
Detects DNS queries containing specific base64-encoded patterns ("UWhRCA" and "BAAAA") that are indicative of Kerberos coercion attacks via DNS object spoofing. This technique involves manipulating DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests, forcing victim systems to authenticate to attacker-controlled hosts. This is a strong indicator of a Kerberos coercion attack, potentially related to vulnerabilities like CVE-2025-33073, where a marshaled CREDENTIAL_TARGET_INFORMATION structure is used.
Detects the loading of the System Informer tool's driver, 'SystemInformer.sys', by checking for its file name or specific SHA256 hashes. System Informer is a legitimate system monitoring tool that can be used by adversaries for reconnaissance or to gain deeper system insights, making its driver load a potential indicator of compromise or unauthorized activity.
Detects the load of HackSys Extreme Vulnerable Driver (HEVD.sys), an intentionally vulnerable Windows driver often abused by threat actors for privilege escalation and other malicious activities. The rule identifies the driver by its filename and known IMPHASH values.
This rule detects the creation of files with a '.scr' extension, which are typically Windows screensaver executable files. Adversaries may create or modify these files to establish persistence by executing malicious content when user inactivity triggers the screensaver. The rule includes filters to reduce false positives from known legitimate processes creating screensaver files, such as Kindle.exe, Symantec Endpoint Protection's ccSvcHst.exe, and TiWorker.exe creating uwfservicingscr.scr.
This rule detects the creation of registry keys associated with NetWire RAT. Specifically, it looks for the creation of a registry key containing '\software\NetWire' in its path, which is a known location where NetWire RAT stores its configuration information.
Detects when a user enables DNS-over-HTTPS (DoH) by modifying specific registry keys for Microsoft Edge, Google Chrome, or Mozilla Firefox. Enabling DoH can obscure internet activity, potentially aiding in data exfiltration or evading network monitoring, as it encrypts DNS queries and bypasses traditional DNS visibility.
Page 212 of 680