SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,730 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory.
It is often used by threat actors for credential dumping and lateral movement within compromised networks.
It is often used by threat actors for credential dumping and lateral movement within compromised networks.
Detects when essential PowerShell DLLs, specifically 'System.Management.Automation.dll', are loaded by processes that are not legitimate PowerShell executables. This behavior can indicate malicious activity, such as an attacker using techniques like meterpreter's 'load powershell' extension or PowerShdll to execute PowerShell commands in a stealthy manner without directly invoking powershell.exe.
Detects when a new rule has been added to the Windows Firewall exception list, specifically looking for uncommon or potentially malicious additions by filtering out common system paths and applications. This rule aims to identify defense evasion attempts where adversaries modify firewall rules to allow their command and control traffic or other malicious network activity.
Detects potential DLL sideloading of 'dbgcore.dll' by identifying instances where this DLL is loaded from non-standard or unexpected file paths. This technique can be used by adversaries for defense evasion, persistence, and privilege escalation.
Detects Windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse these programs to proxy execution of malicious code, bypassing application control and potentially evading detection. The rule specifically targets `InstallUtil.exe`, `RegAsm.exe`, `RegSvcs.exe`, `regsvr32.exe`, and `rundll32.exe` when they load DLLs that are not signed or have an invalid signature status. It includes filters for common legitimate scenarios to reduce false positives.
Detects the removal of a port or application rule in the Windows Firewall configuration using the netsh.exe command-line utility. This activity can be indicative of an adversary attempting to impair defenses to facilitate further malicious activity.
Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'.
This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap.
These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)
This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap.
These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)
Detects the creation of executable files with names identical to legitimate Windows system processes in directories other than their standard system locations (e.g., System32, SysWOW64). This technique is often used by adversaries for defense evasion and masquerading to blend malicious executables with legitimate system files.
Detects the creation of PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories by processes that are not recognized as legitimate PowerShell executables or installers. This can indicate an attempt to establish persistence or execute malicious code by injecting or creating malicious PowerShell modules.
Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
Page 271 of 680