SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,767 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive activity aiming to impact business operations.
This rule detects the creation of files with specific naming conventions and extensions that are indicative of exported or stolen DPAPI backup keys and certificates. These patterns are commonly associated with tools like Mimikatz and DSInternals, which adversaries use to extract credentials and cryptographic material from Windows systems. The rule looks for filenames containing "ntds_capi_", "ntds_legacy_", or "ntds_unknown_" and ending with ".cer", ".key", ".pfx", or ".pvk".
This rule detects the execution of various Windows-based hacktools by matching their import hash (imphash). This method allows for detection even if the tool's filename has been changed. The rule includes imphashes for tools such as PetitPotam, JuicyPotato, RoguePotato, Pwdump, Cobalt Strike beacons, PPLDump, NanoDump, HandleKatz, DripLoader, UACMe, WCE, Sliver Stagers, Dumpert, SysmonEnte, SysmonQuiet, ShaprEvtMute Hook, Forkatz, PPLKiller, Backstab, Forensia, EDRSandBlast, and EDRSilencer.
This rule detects the creation of remote PowerShell sessions by monitoring for the 'wsmprovhost.exe' process. It triggers when 'wsmprovhost.exe' appears as either the main process image or as a parent process, indicating an active PowerShell remote session, typically facilitated by Windows Remote Management (WinRM).
Detects remote RPC calls to read information about scheduled tasks via AtScv. This activity can indicate an adversary performing reconnaissance to understand the environment and identify potential lateral movement opportunities.
Detects when an Azure Kubernetes Cluster is created or deleted. This activity can indicate significant infrastructure changes, either legitimate or malicious. Monitoring these operations is crucial for maintaining the security and integrity of containerized environments.
This rule detects attempts to create or rename files with a space at the end of their filename, which can be used to obfuscate malicious files or commands. Specifically, it looks for command-line executions involving 'echo "*" > * && chmod +x *' or 'mv * "* "'. The first pattern suggests creating an executable file with a trailing space, and the second suggests renaming a file to include a trailing space.
This rule detects the installation of Microsoft Installer (MSI) packages directly from a web source. It specifically looks for MsiInstaller events (EventID 1040 or 1042) in the Windows Application event log where the installation data contains a web protocol indicator (e.g., '://'). This behavior can be indicative of an attacker using msiexec.exe to download and execute malicious MSI files from a remote server, potentially bypassing traditional security controls.
Detects uncommon network connections to the Active Directory Web Services (ADWS) on port 9389 from processes not typically associated with ADWS management. This can indicate an adversary performing discovery of Active Directory information.
Detects the execution of mstsc.exe (Microsoft Terminal Services Client) when its parent process is an uncommon application, specifically web browsers or email clients. This behavior can indicate an adversary attempting to establish an RDP connection after downloading or receiving a malicious .rdp file, potentially as part of an initial access or lateral movement attempt.
Page 322 of 680