SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,735 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects DNS queries to domains within known low reputation Effective Top-Level Domains (eTLDs). These eTLDs are often associated with malicious activities such as command and control, phishing, or malware distribution. The rule leverages a curated list of suspicious eTLDs, which is updated periodically.
This rule detects the creation of Windows Defender Application Control (WDAC) policy files (.cip or .p7b) within the `C:\Windows\System32\CodeIntegrity\` folder by a process running with 'High' integrity. Attackers can leverage this technique to deploy custom WDAC policies that block Endpoint Detection and Response (EDR) components, effectively bypassing security measures and enabling undetected malicious activity after a system reboot.
Detects the execution of commands via the Windows Run dialog box by monitoring modifications to the `RunMRU` registry key. This technique is often abused by threat actors to trick users into pasting and executing malicious commands, sometimes disguised as CAPTCHA verification steps. The rule filters out common legitimate entries to reduce false positives.
Detects the download of suspicious file types (batch, command, PowerShell scripts) from well-known file and paste sharing domains. This rule specifically looks for the creation of Zone.Identifier alternate data streams on these file types, which indicates they were downloaded from the internet.
Detects the exploitation of CVE-2022-37966, a security bypass and elevation of privilege vulnerability in Kerberos that allows for weak RC4-HMAC negotiation. This event indicates a Kerberos KDC error related to this vulnerability.
Detects the addition of a new module to an IIS server. Adversaries may install malicious IIS modules to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic. This can be used to establish persistence or for defense evasion.
Detects the usage of command-line tools such as 'net', 'sc', 'powershell', 'wmic', or 'psservice' to stop, pause, disable, or delete critical Windows services. This activity is often observed in ransomware attacks and other malicious campaigns aiming to evade defenses or cause impact by targeting security software, backup solutions, and other essential system services.
Detects changes to the IIS server configuration to disable HTTP logging for successful requests. This can be an indicator of an adversary attempting to hide their activity on a compromised web server.
This rule detects the use of PowerShell (powershell.exe or pwsh.exe) to download files from known file-sharing or content delivery network (CDN) domains. It specifically looks for command-line arguments indicative of file download operations, such as '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', 'iwr', and 'wget'. The rule aims to identify suspicious activity where PowerShell is leveraged to retrieve potentially malicious payloads from untrusted or commonly abused online services.
Detects raw disk access attempts by uncommon tools or tools located in suspicious directories. This activity could indicate defense evasion, potentially to bypass file system monitoring or access controls.
Page 281 of 680