SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,730 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of the EnableRegion command in AWS CloudTrail logs.
While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately.
There may be situations where security monitoring does not cover some new AWS regions.
Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment.
While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately.
There may be situations where security monitoring does not cover some new AWS regions.
Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment.
This rule detects when specific Windows executables (csrss.exe, lsass.exe, RuntimeBroker.exe, sihost.exe, smss.exe, wininit.exe, winlogon.exe, dllhost.exe, rundll32.exe, svchost.exe) write files with suspicious extensions such as .bat, .dll, .exe, .hta, .iso, .ps1, .txt, .vbe, and .vbs. This behavior can indicate defense evasion or other malicious activity where legitimate system processes are abused to drop or create malicious files.
Detects potential persistence established through the modification of registry keys related to Visual Studio Tools for Office (VSTO) add-ins for Microsoft Office applications like Outlook, Word, Excel, and PowerPoint. Adversaries can leverage VSTO add-ins to execute malicious code when an Office application starts, thereby maintaining persistence on a compromised system. The rule specifically looks for changes to the 'Addins' registry paths for various Office applications and the VSTO Security Inclusion path, while filtering out common legitimate processes that might make such changes.
Detects the loading of 'Amsi.dll' by specific Living Off the Land Binaries (LOLBINs) such as ExtExport.exe, odbcconf.exe, and rundll32.exe. This activity can indicate an attempt to bypass Antimalware Scan Interface (AMSI) protections, often associated with 'PowerShell without PowerShell' attacks where malicious scripts are executed without directly invoking powershell.exe.
Detects usage of known PowerShell cmdlets such as "Clear-EventLog", "Remove-EventLog", "Limit-EventLog", "Clear-WinEvent", or direct .NET calls to clear Windows event logs. This activity is often performed by adversaries to remove forensic evidence of their actions on a compromised system.
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects potential DLL sideloading of "dbghelp.dll" by identifying instances where this DLL is loaded from a non-standard or unexpected directory. This technique can be used by adversaries for defense evasion, persistence, or privilege escalation.
Page 272 of 680