SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,767 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious processes based on name and location that access the Windows Credential Manager and Vault. This activity can be indicative of credential stealing, such as that performed by Mimikatz's "dpapi::cred" function.
This rule detects attempts by uncommon applications to access Windows Data Protection API (DPAPI) Master Keys. Such access can indicate credential theft, for example, through tools like Mimikatz's "dpapi::masterkey" function. The rule specifically looks for file access requests to the DPAPI master key directories for both system and user accounts, while filtering out access from common system and program files locations to reduce false positives.
This rule detects the execution of the Node.js executable that is bundled with Adobe Creative Cloud, specifically when it is used to execute scripts outside of the legitimate 'Adobe Creative Cloud Experience\js' directory. This behavior can indicate an adversary attempting to leverage a trusted application's bundled interpreter for malicious script execution, potentially bypassing application control or whitelisting solutions.
Detects rundll32 execution where the DLL is located on a remote network share (UNC path). This technique is often used by adversaries for defense evasion, execution, and lateral movement by leveraging a legitimate Windows utility to load and execute malicious code from a remote location.
Detects the execution of PsExec, a legitimate but often abused tool for remote command execution. The rule specifically looks for the executable name 'psexec.exe' or its original filename 'psexec.c' in process creation events.
This rule detects remote RPC calls made to query information about scheduled tasks. Specifically, it monitors for RPC Firewall events (EventID 3) with a specific InterfaceUuid (86d35949-83c9-4044-b424-db363231fd0c) which corresponds to the ITaskSchedulerService. The rule filters out common operational numbers (OpNum 1, 3, 4, 10, 11, 12, 13, 14, 15) to reduce false positives, focusing on less common or potentially malicious reconnaissance activities related to scheduled tasks.
Detects suspicious log entries in Linux log files
This rule detects the execution of 'esentutl' with the '/p' parameter. This command-line utility is used for database utilities, and its use with '/p' (repair mode) can be leveraged by adversaries to access or repair Extensible Storage Engine (ESE) databases, including the NTDS.dit file which contains Active Directory credential information. This technique has been observed in use by threat actors like Conti ransomware and Trickbot to gather credentials or other sensitive information from compromised systems.
Detects when a Kubernetes RoleBinding or ClusterRoleBinding is created, modified, or deleted. This activity can indicate privilege escalation attempts or unauthorized access within a Kubernetes cluster.
Detects the registration of a new ODBC driver where the driver's DLL is located in a potentially suspicious or non-standard system directory. Adversaries may use this technique to establish persistence or facilitate credential access by registering malicious ODBC drivers.
Page 323 of 680