SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,735 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects errors when a target server doesn't have suitable keys for generating kerberos tickets.
This issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.
This issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.
Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence
Detects the creation of a new service using the "sc.exe" utility.
Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility
Detects the use of the PsLogList utility to dump Windows event logs (security, application, system) or to clear them. This activity can be indicative of account discovery attempts or anti-forensics techniques by adversaries.
This rule detects the creation of a process using 'ssh.exe' with command-line arguments indicative of remote port forwarding. Specifically, it looks for the '-R' flag, which is used to specify remote port forwarding in SSH. This activity can be used by adversaries for command and control or lateral movement by tunneling network communications.
This rule detects the execution of the 'getcap' binary on Linux systems. Adversaries often use 'getcap' during reconnaissance to identify binaries with special capabilities that could be exploited for privilege escalation, such as GTFOBins or other vulnerable executables. The rule specifically looks for the use of 'getcap' with the '-r' flag, which recursively lists capabilities.
This rule detects the execution of the `certutil.exe` utility specifically when it is used with the `-exportPFX` flag. This flag allows `certutil.exe` to export certificates, potentially including private keys, into a Personal Information Exchange (PFX) file. This activity can be indicative of an adversary attempting to steal credentials or establish persistence by exporting legitimate certificates for later use in impersonation or decryption.
Detects the creation of a new Windows service (EventID 7045) where the service's ImagePath contains suspicious command-line flags ('-c', '-r', '-k') often used with scripting engines, and the ImagePath itself references common scripting or proxy execution binaries such as cscript, mshta, powershell, pwsh, regsvr32, rundll32, or wscript. This combination indicates an attempt to install a service that executes a script or uses a living-off-the-land binary for malicious purposes, potentially for persistence or privilege escalation.
This rule detects the execution of 'cmdkey.exe' with the '-l' argument, which is used to list cached credentials on a Windows system. This activity is often associated with reconnaissance for cached credentials by adversaries.
Page 284 of 680