SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,732 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code
Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Detects creation of a new service (kernel driver) with the type "kernel"
Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.
Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys. Specifically, it looks for HTTP/HTTPS links combined with suspicious keywords related to CAPTCHA/verification or common command-line utilities, which are indicative of clipboard hijacking and execution of remotely hosted malicious files or scripts.
Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID). This could be a sign of exploitation of elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
Detects the creation of '.library-ms' files by common archive extraction tools or Windows Explorer, which may indicate an attempt to exploit CVE-2025-24054. This vulnerability can lead to automatic outbound SMB or WebDAV authentication requests, potentially exposing NTLMv2-SSP hashes to an attacker without user interaction beyond archive extraction on unpatched systems.
This rule detects the execution of Visual Studio Code's tunnel feature. Attackers can abuse this functionality to establish a command and control (C2) channel, allowing them to remotely control a compromised system. The rule looks for specific command-line arguments associated with the tunnel feature, including '.exe tunnel' and '--accept-server-license-terms'. It also identifies scenarios where 'cmd.exe' is used as a parent process to launch the tunnel, specifically looking for 'code-server.cmd' within the command line.
Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.
Page 279 of 680