SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,687 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects GitHub activity associated with the 'Shai-Hulud' NPM supply chain attack. The attack involves malicious NPM packages that use stolen GitHub tokens to create a new branch, inject a malicious workflow file to exfiltrate secrets, and make private repositories public.
This rule detects attempts to modify system services or WMI settings, which are behaviors associated with the Blue Mockingbird cryptominer. Specifically, it looks for 'sc config' commands that include 'wercplsupporte.dll' and 'wmic.exe' commands ending with 'COR_PROFILER'. These command-line patterns indicate potential persistence or defense evasion mechanisms used by the threat.
Detects specific Windows registry modifications made by BlackByte ransomware variants. BlackByte sets three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption. This rule triggers when any of the specified registry keys are set to DWORD 1.
Detects the execution of 'more.com' as a parent process and 'vbc.exe' as a child process. This specific process tree behavior has been observed in samples related to the Lummac Stealer, where the Lummac payload is injected into the 'vbc.exe' process.
Detects the creation or modification of a custom protocol handler in the Windows Registry with the name "rogue" and a specific CLSID. This activity has been observed as a persistence mechanism used by the Forest Blizzard APT group (also known as Star Blizzard or COLDRIVER). By setting a custom protocol handler, the adversary can execute arbitrary code when a specially crafted URI is accessed.
Detects suspicious child processes created by CrushFTP, which could indicate the exploitation of a Remote Code Execution (RCE) vulnerability like CVE-2025-54309. The rule specifically looks for PowerShell, cmd, bitsadmin, certutil, mshta, cscript, or wscript processes spawned by CrushFTP, often with command-line arguments indicative of malicious activity (e.g., IEX, encoded commands for PowerShell, or common system commands for cmd).
Detects when a transfer lock was removed from an AWS Route 53 domain. This action is typically performed when intending to transfer the domain to a different registrar, but it can also be an indicator of malicious activity if unauthorized. Disabling the transfer lock makes the domain vulnerable to unauthorized transfers, which could lead to domain hijacking or redirection of traffic.
This rule monitors and alerts when a user is added to the 'Global Administrator' or 'Device Administrator' roles within Azure Active Directory. These roles grant highly elevated privileges, making this activity critical for detecting potential persistence, privilege escalation, or initial access attempts by adversaries. The detection logic specifically looks for 'Add member to role' operations within the RoleManagement category, targeting the unique identifiers for these two sensitive administrative roles.
Detects when a configuration change is made to an application's AppID URI in Azure Active Directory (now Microsoft Entra ID). This change can be indicative of an adversary attempting to modify an application's identity to facilitate malicious activities such as phishing, unauthorized access, or maintaining persistence.
Detects when a user is removed from a privileged role in Azure AD. Bulk changes should be investigated as they could indicate an adversary attempting to remove legitimate administrators or clean up their tracks after gaining access.
Page 218 of 680