SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,767 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of 'gpg.exe' or 'gpg2.exe' from uncommon locations. This activity is often associated with ransomware and loaders that use GnuPG for encrypting or decrypting data.
Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing, for example, the usage of Mimikatz's "dpapi::credhist" function. The rule filters out common legitimate system processes and applications to reduce false positives.
Detects suspicious encoded character syntax often used in PowerShell for defense evasion, specifically looking for '[char]0x' or '(WCHAR)0x' in command lines, which are common methods to obfuscate commands.
Detects the creation or modification of a Windows domain group named "ESX Admins". This activity is suspicious because VMware ESXi hypervisors joined to an Active Directory domain grant full administrative access by default to members of a group with this specific name. This could indicate a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate privileges on a domain-joined ESXi hypervisor.
Detects file access requests to Windows Outlook Mail data files by uncommon processes. This could indicate a potential attempt to steal credentials or sensitive information from Outlook mailboxes. The rule requires significant baselining to reduce false positives.
Detects a renamed PowerShell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths. The rule specifically looks for PowerShell classic logs where the 'HostName' is 'ConsoleHost' but the 'HostApplication' field does not contain typical PowerShell executable paths or names, indicating a potential renaming or masquerading attempt.
Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators
Detects the presence and execution of Inveigh via dropped artefacts
Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.
Page 325 of 680