SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,698 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when a user without the necessary permissions attempts to invite a guest user in an Azure environment, indicated by a failed 'Invite external user' operation in the audit logs. This could signify an attempt at unauthorized access, privilege escalation, or persistence.
This rule detects the successful creation of a new administrative account within an Azure environment. It specifically looks for audit log entries indicating both 'Add user' and 'Add member to role' actions occurring successfully, which signifies a user being created and then assigned a privileged role.
Detects failed authentication attempts originating from geographic locations (countries) that are not part of the organization's approved operational regions. This rule helps identify potential unauthorized access attempts or credential stuffing attacks from unexpected sources.
This rule detects attempts to capture user credentials on macOS by leveraging the `osascript` utility to display system dialog prompts. It specifically looks for `osascript` executions that include commands to 'display dialog' with keywords commonly associated with credential requests, such as 'admin', 'password', 'authenticate', or 'credentials'. This technique can be used by adversaries to present seemingly legitimate pop-ups to trick users into entering their credentials.
This rule detects a DHCP server error where a specified Callout DLL, configured in the registry, could not be loaded. This event can indicate an attempt to inject a malicious DLL into the DHCP server process for persistence, privilege escalation, or defense evasion.
This rule detects when a DHCP server loads a specified Callout DLL, which can be abused for persistence, privilege escalation, or defense evasion. Adversaries might inject malicious DLLs into legitimate processes like the DHCP server to maintain access or elevate privileges on a system.
This rule detects the creation of an executable file named 'program.exe' directly in the root of the C:\ drive. This specific file name and location are commonly associated with attempts to exploit unquoted service paths, where an attacker places a malicious executable in a higher-level directory to be executed instead of the legitimate program due to the lack of quotation marks in the service path.
This rule detects file write operations performed by 'scrcons.exe' (WMI Scripting Host). This activity is indicative of WMI persistence mechanisms, specifically the creation or modification of WMI script event consumers. Adversaries often use WMI event subscriptions to establish persistence and execute arbitrary code when a defined event occurs, such as system startup or user logon. The detection focuses on the 'Image' field, looking for the specific WMI scripting host executable.
This rule detects PowerShell commands that attempt to copy files into critical Windows system directories like "System32" or "SysWOW64". This activity can be indicative of persistence mechanisms, defense evasion, or credential access attempts, such as installing a malicious password filter DLL.
Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware. The rule specifically looks for `wmic.exe` or `wmiprvse.exe` as a parent process, executing `reg.exe add` commands to modify `Run` registry keys, and targeting suspicious file paths commonly used by malware for persistence.
Page 228 of 680