SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,684 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects an unexpected file deletion by the dns.exe process. This activity could indicate remote code execution or other forms of exploitation, potentially related to vulnerabilities like CVE-2020-1350 (SigRed), where an attacker might manipulate DNS server files.
This rule detects the creation of specific named pipes ('\imposecost' or '\imposingcost') which are known to be used by the 'Koh' tool. The 'Koh' tool is associated with credential access and privilege escalation techniques, often involving token impersonation or theft. Detection relies on Sysmon Event ID 17 or 18, which logs named pipe creation.
Detects the creation of an interactive AT job, which can be used for privilege escalation or persistence. The rule specifically looks for the execution of 'at.exe' with the 'interactive' command-line argument.
This rule detects modifications to the AppInit_DLLs registry key, which can be used by adversaries to establish persistence or elevate privileges. DLLs specified in this key are loaded by user32.dll into nearly every process that loads user32.dll. The rule specifically looks for changes to the 'AppInit_Dlls' value within the 'HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows' and 'HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows' registry paths, excluding empty values.
Detects the execution of WinSCP with the "-command" and "open" flags to establish an FTP or SFTP connection. This technique has been observed in use by the Akira ransomware group for data exfiltration.
Detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call. Adversaries may delete flow logs to evade detection or remove evidence of network activity, hindering forensic investigations and visibility into malicious operations.
This rule detects the creation of specific Windows services ('srservice', 'ipvpn', 'hkmsvc') that have been identified as malicious by ESET in their 'Carbon Paper - Turla' report. These services are associated with the Turla APT group's second-stage backdoor, indicating potential privilege escalation and persistence mechanisms.
Detects the creation of specific Windows services ('SC Scheduled Scan' or 'UpdatMachine') that have been associated with the OilRig APT group for persistence, as reported by Nyotron in their March 2018 report. This rule monitors EventID 7045 from the 'Service Control Manager' provider.
This rule detects exploitation attempts of the privilege escalation vulnerability CVE-2019-1378. The vulnerability involves the Windows 10 Update Assistant (WUA) executing `SetupComplete.cmd` or `PartnerSetupComplete.cmd` with elevated privileges. An attacker can place a malicious script in `C:\Windows\Setup\Scripts\` which will then be executed by `cmd.exe` during the update process, leading to privilege escalation. The rule specifically looks for `cmd.exe` being the parent process, executing a command line that contains `C:\Windows\Setup\Scripts\` and ends with either `SetupComplete.cmd` or `PartnerSetupComplete.cmd`, while filtering out legitimate system processes that might also execute commands from these directories.
Detects activity mentioned in the Operation Wocao report, specifically the use of 'checkadmin.exe' to enumerate local administrators. This tool is used by the threat actor to identify potential targets for privilege escalation or lateral movement.
Page 220 of 680