SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,743 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects when the Sysmon utility is executed with the '-c' command-line argument, indicating an attempt to update or modify its configuration. Attackers might leverage this to disable or alter Sysmon's monitoring capabilities, thereby evading detection without fully shutting down the service.
Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode.
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server.
Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Detects port forwarding activity via SSH.exe
Detects the dual-use tool ADExplorer writing a complete Active Directory snapshot into a .dat file. This activity can be leveraged by attackers for various purposes, including data extraction for tools like Bloodhound, gathering usernames for password spraying attacks, or utilizing metadata for social engineering. While the snapshot typically does not contain password hashes, there have been instances where administrators inadvertently stored passwords in comment fields within Active Directory, which could then be exposed through such snapshots.
This rule detects attempts to disable Multi-Factor Authentication (MFA) within Microsoft 365 services. Specifically, it looks for audit log entries containing the operation 'Disable Strong Authentication.' This action could be performed by an attacker to maintain persistent access to compromised accounts by removing an important security layer.
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag to save a local copy of the Active Directory database. This activity is suspicious as it can be used by attackers to extract data for Bloodhound, gather usernames for password spraying, or obtain metadata for social engineering. While the snapshot typically doesn't contain password hashes, administrators sometimes store passwords in comment fields, which could be exposed.
This rule detects potential enumeration of AWS S3 buckets by looking for the 'ListBuckets' API call in AWS CloudTrail logs. It specifically filters out activities performed by 'AssumedRole' identities to reduce false positives from legitimate automated processes or services.
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag to create a local copy of the Active Directory database. This activity can be used by attackers for various purposes, including extracting data for Bloodhound, gathering usernames for password spraying, or leveraging metadata for social engineering. While the snapshot does not contain password hashes, administrators sometimes store passwords in comment fields, which could be exposed.
Detects the addition of a new Federated Domain within Microsoft 365 audit logs. This activity can be a legitimate administrative action but also indicates potential federated credential abuse or the establishment of a backdoor via federated identities.
Page 291 of 680