SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,720 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects attempts by non-system accounts to create or write to files on administrative shares (e.g., C$) via Server Message Block (SMB). This activity is often associated with lateral movement or persistence techniques where attackers drop tools or establish footholds on remote systems.
Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) spawning suspicious child processes. This activity is uncommon for baaupdate.exe and could indicate an attempt at lateral movement or defense evasion, potentially via BitLocker DCOM & COM Hijacking, by using baaupdate.exe as a proxy for executing other system utilities.
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
Detects the loading of WSMAN provider DLLs by processes other than the expected svchost.exe, or by svchost.exe with an unexpected original filename. This can indicate local or remote execution using Windows Remote Management (WinRM) or Windows Management Instrumentation (WMI) for lateral movement or execution, potentially by an attacker.
This rule detects the loading of the 'vssapi.dll' library by executables that are not commonly associated with legitimate Volume Shadow Copy operations. Adversaries often interact with Volume Shadow Copy Service (VSS) DLLs to delete shadow copies, which is a common technique to inhibit system recovery and prevent data restoration after ransomware attacks or data destruction.
Detects when a request has been made to transfer a Route 53 domain to another AWS account.
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Detects the execution of the 'ping.exe' command with a hexadecimal encoded IP address in the command line. This technique is often used by adversaries for defense evasion, specifically to obfuscate network communication or command and control activities, making it harder for security tools to detect the target IP address.
Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.
It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
This rule detects the execution of 'netsh.exe' with command-line arguments indicating an attempt to discover firewall configurations. Specifically, it looks for 'netsh' combined with 'show firewall' and additional keywords like 'config', 'state', or 'rule', or 'name=all'. This activity is often performed by adversaries to understand the network environment and identify potential egress points or defensive measures.
Page 255 of 680