SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,735 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the removal of a previously installed IIS module.
Detects changes to the IIS server configuration to disable or remove the ETW (Event Tracing for Windows) logging/processing option. This could indicate an adversary attempting to evade detection by reducing the logging capabilities of the web server.
Detects errors when a target server doesn't have suitable keys for generating Kerberos tickets. This issue can occur, for example, when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled. This can indicate a misconfiguration or an attempt by an attacker to exploit weak encryption types.
Detects potentially suspicious file downloads from known file-sharing domains using `wget.exe`. This rule looks for `wget.exe` execution where the command line includes common file-sharing or code-hosting domains, an HTTP/HTTPS URL, and flags indicating an output file (e.g., `-O` or `--output-document`). It also specifically looks for downloads of common executable or script file extensions, such as `.exe`, `.dll`, `.ps1`, `.bat`, `.vbs`, `.hta`, and `.msi`.
Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID)
This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping.
Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping.
Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
Detects attempts to access the PowerShell console history file (ConsoleHost_history.txt) or retrieve its path. This activity can indicate an adversary attempting to gather plaintext credentials or perform reconnaissance on previously executed commands.
Detects the installation and configuration of a TacticalRMM agent where specific command-line flags (--api, --auth, --client-id, --site-id, --agent-type) are used. This indicates the agent is being configured to connect to a particular RMM server with authentication and client/site identification. This activity could signify a threat actor attempting to register the agent with their own controlled RMM infrastructure for persistent remote access.
Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious.
Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development.
Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems.
Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation.
Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development.
Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems.
Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation.
Detects the execution of Regsvr32.exe with DLL files that have been renamed or masqueraded with suspicious file extensions. This technique is often used by adversaries for defense evasion and to bypass application control by proxying execution through a legitimate Windows binary.
Detects the creation of a new service using the "sc.exe" utility. This activity can be used by adversaries for persistence or privilege escalation by creating a malicious service that executes at system startup or with elevated privileges.
Page 282 of 680