SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,757 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects PowerShell scripts leveraging the "Invoke-WebRequest" cmdlet to send data via either "PUT" or "POST" method.
Detects a network connection initiated by a binary to "api.mega.co.nz".
Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.
Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.
Detects network connections to Cloudflared tunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2
Detects the suspicious loading of `vss_ps.dll` by executables that are not typically associated with the Volume Shadow Copy Service (VSS). This DLL is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts, commonly seen in ransomware attacks or other destructive operations. The rule filters out known legitimate processes and common program file locations to reduce false positives.
Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments.
This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.
This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.
Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access
This rule detects attempts to transfer sensitive files containing credential data via network shares. It specifically looks for Event ID 5145 (A network share object was checked to see whether client can be granted desired access) and checks if the 'RelativeTargetName' of the accessed object contains well-known filenames or paths associated with credential storage, such as Mimikatz output, LSASS memory dumps, Windows minidumps, hibernation files, SQL dumps, or critical system files like NTDS.dit, SAM, SECURITY, and SYSTEM hives.
Detects potential Active Directory enumeration via LDAP. This rule identifies suspicious LDAP search filters and distinguished name enumerations that are commonly used by reconnaissance tools like PowerView and SharpHound to gather information about users, groups, computers, and domain trusts within an Active Directory environment. The rule specifically looks for various 'groupType', 'sAMAccountType', 'objectCategory', 'objectClass', 'primaryGroupID', 'userAccountControl' attributes, and specific distinguished names or flags that indicate detailed AD reconnaissance.
Page 299 of 680