SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,767 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of the default output filename used by the wmiexec tool, which is part of the Impacket toolkit. This typically indicates lateral movement or execution of commands via WMI.
Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, or a set of spaces or underlines to cloak the executable file, often used in spear phishing campaigns to trick users into executing malicious files.
This rule detects remote procedure calls (RPC) targeting the MS-SRVS interface (UUID: 4b324fc8-1670-01d3-1278-5a47bf6ee188) which is associated with the Server Service. Abuse of this service can be used for lateral movement within a network, potentially for creating remote shares or other administrative functions. The detection relies on logs from an RPC Firewall.
Identifies when a service account in Azure Kubernetes Service is modified or deleted. This could indicate an adversary attempting to disrupt services, remove access, or manipulate accounts for persistence or privilege escalation within the Kubernetes cluster.
Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled. This rule specifically looks for Event ID 4719, which indicates a change in audit policy, combined with specific Subcategory GUIDs and audit policy change codes ('%%8448' for Success removed or '%%8450' for Failure removed).
This rule detects when 'amsi.dll' is loaded by processes that are not commonly expected to load it. AMSI (Antimalware Scan Interface) is a Windows component that allows applications to integrate with installed antimalware products. Adversaries often attempt to bypass AMSI to execute malicious code without detection. This rule aims to identify such bypass attempts by flagging unusual process-AMSI.dll load combinations. The rule explicitly filters out common legitimate processes and directories that are known to load amsi.dll, such as explorer.exe, Sysmon64.exe, processes in Program Files, System32, SysWOW64, WinSxS, Windows Defender's MsMpEng.exe, and .NET framework related ngentask.exe processes.
Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", "last", "uname", "users", "w", and "who" on Linux systems. Adversaries use these commands to gather information about the system and its users to inform subsequent actions.
Detects remote RPC calls that perform remote DCOM operations, which can be abused for lateral movement via DCOM or WMI. The rule specifically looks for RPC Firewall events with EventID 3 and a set of Interface UUIDs associated with DCOM and WMI activities.
This rule detects the creation of specific files associated with the Octopus Scanner malware. The malware creates files named 'Cache134.dat' and 'ExplorerSync.db' within the user's local AppData\Microsoft directory. This activity is indicative of the malware's presence and operation.
Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse. The rule specifically looks for PowerShell script block text containing commands related to installing the Windows feature, installing the PSWA web application, and adding authorization rules.
Page 318 of 680