SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,679 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects changes to the AWS Identity Center (formerly AWS SSO) identity provider configuration. Such changes, including associating, disassociating, enabling, or disabling an external identity provider, could be used by an attacker to establish persistent access or escalate privileges through user impersonation.
This rule identifies when an admission controller is executed in Azure Kubernetes. Admission controllers intercept and potentially modify requests to the Kubernetes API server. Adversaries can leverage admission webhooks (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) for persistence, such as injecting malicious containers into pods or intercepting API requests to steal credentials and sensitive information.
This rule detects when a user registers security information, which indicates a change to their authentication method. This could be an attacker adding an authentication method to a compromised account to maintain persistent access.
This rule detects sign-in attempts to Azure Active Directory from devices that are marked as non-compliant. Non-compliant devices typically lack required security configurations, updates, or policies, and their use for authentication can indicate a potential security risk, such as a compromised device or an attempt to bypass security controls.
Detects the execution of programs as Launch Agents or Launch Daemons using the `launchctl` command on macOS. This activity can be indicative of persistence mechanisms established by adversaries.
Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472, also known as Zerologon. This vulnerability allows an unauthenticated attacker to gain domain administrator privileges.
Detects the installation of a PDQDeploy service on a machine. PDQDeploy is a legitimate system management tool that can be leveraged by attackers to remotely install packages or execute commands on target machines, leading to persistence or privilege escalation.
Detects PowerShell writing shortcut (.lnk) files into the Windows startup directory. This technique is commonly used by adversaries to establish persistence, ensuring their malicious code executes each time a user logs in. The rule specifically looks for PowerShell (powershell.exe or pwsh.exe) as the process creating these shortcut files in the 'Start Menu\Programs\Startup' path.
This rule detects when a file is written to the Windows startup directory. This activity is a common technique used by adversaries to establish persistence on a system, ensuring that their malicious code executes automatically when a user logs in or the system boots. The rule specifically looks for file creation events where the target filename contains the path to the 'Start Menu\Programs\StartUp' directory. It includes filters to reduce false positives from legitimate system processes like Windows Update and Microsoft OneNote.
Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.
Page 214 of 680