SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,722 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service
Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)
Detects persistence registry keys for Recycle Bin
Detects VBScript content stored into registry keys as seen being used by UNC2452 group
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.
The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time
The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time
Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker. Adversaries may create this file to test AppLocker policies or to bypass them.
Detects the execution of the Restic backup tool, which can be used for data exfiltration.
Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services.
If not legitimately used in the enterprise environment, its presence may indicate malicious activity.
Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services.
If not legitimately used in the enterprise environment, its presence may indicate malicious activity.
Detects the execution of LaZagne, a utility used to retrieve multiple types of passwords stored on a local computer. LaZagne has been leveraged by threat actors to dump credentials.
This rule detects the usage of the 'SeLoadDriverPrivilege' privilege, which is necessary to load or unload device drivers. This privilege allows a user to dynamically load and unload kernel-mode code, excluding Plug and Play device drivers. The rule aims to identify potentially malicious kernel driver loading by filtering out known legitimate processes and tools. It specifically mentions detecting tools like Ghost-In-The-Logs and Sysinternals, indicating that a whitelist approach is required to reduce false positives.
Detects potential DLL sideloading of DLLs that are part of antivirus software such as McAfee, Symantec, Bitdefender, F-Secure, CyberArk, Avast, ESET, and Trend Micro. The rule identifies when specific DLLs associated with these security products are loaded from an unexpected or non-standard directory, indicating a possible attempt to hijack the execution flow.
Page 261 of 680