SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,742 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges
Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe".
This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.
In order to dump the process memory or perform other nefarious actions.
This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.
In order to dump the process memory or perform other nefarious actions.
Detects the execution of "whoami.exe" with the "/all" flag
Detects the addition of a new network route to a route table in AWS. This activity can be indicative of an adversary attempting to reroute traffic for C2, exfiltration, or to bypass network controls.
Detects modifications to file or folder permissions using common Windows command-line utilities such as cacls, icacls, net, attrib, and takeown. This can indicate an adversary attempting to evade access controls or gain access to protected files.
Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. Devtunnels can be used for command and control or data exfiltration by tunneling traffic over legitimate-looking DNS requests.
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
This rule detects when AWS Config service components, specifically delivery channels or configuration recorders, are disabled. Adversaries may disable these services to impair an organization's ability to monitor and audit changes within their AWS environment, thereby hindering detection of malicious activities.
This rule detects critical changes to AWS CloudTrail configurations, specifically when a CloudTrail is stopped (StopLogging), updated (UpdateTrail), or deleted (DeleteTrail). These actions can indicate an attempt by an attacker to evade detection by disabling or modifying logging capabilities to obscure their activities within the AWS environment.
This rule detects the creation of new network Access Control List (ACL) entries within an AWS route table. Such an event could indicate that new network access vectors have been opened, potentially allowing unauthorized access or facilitating malicious activities within the AWS environment. This is a critical security event as it directly impacts network segmentation and access control.
Page 293 of 680