SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,723 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.
Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".
Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".
Detects a WMI backdoor in Exchange Transport Agents via WMI event filters
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Detects an office suite application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports. This rule specifically looks for network connections initiated by these applications, excluding common ports used for DNS, HTTP, HTTPS, SMB, LDAP, and specific Outlook-related ports (IMAP, POP3, SMTP).
Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json.
The db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data.
Since the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials.
Currently the rule only covers the default Signal installation path in AppData\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed.
The db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data.
Since the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials.
Currently the rule only covers the default Signal installation path in AppData\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed.
Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert JavaScript for persistence
Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.
Detects the execution of arbitrary DLLs or unsigned code via '.csproj' files using the 'dotnet.exe' utility. This technique can be used for defense evasion and proxy execution.
Page 257 of 680