SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,770 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of 'cmd.exe' specifically when initiated by the AnyViewer Remote Monitoring and Management (RMM) agent during a remote management session. This activity could indicate an adversary using the legitimate remote access tool to execute commands on a compromised system.
This rule detects attempts by uncommon applications to access cryptocurrency wallet files. It specifically looks for file access requests to common cryptocurrency wallet paths for Ethereum, Ethereum Classic, Monero, Bitcoin, BitcoinABC, BitcoinSV, DashCore, DogeCoin, Litecoin, Ripple, and Zcash. The rule filters out access by common system processes, applications installed in standard Program Files directories, and Windows Defender components to reduce false positives. This activity could indicate an attempt to steal cryptocurrency wallets.
Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share by applications that are not commonly expected to access these files. This can indicate an attempt to gather credentials or configuration details from Group Policy Objects.
Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of USB flash drives, SD cards, External hard disk drives, and other drives formatted with NTFS, FAT16, FAT32, or exFAT file systems. This is a rarely used application, and its usage is worth investigating. Malware such as Lumma Stealer has been observed using this process as a target for process hollowing.
This rule monitors for attempts to write potentially malicious files into the C:\Windows\Fonts\ directory using command-line utilities. This folder is often targeted by adversaries because it typically does not require administrative privileges for writing and execution, making it a suitable location for defense evasion and persistence. The rule specifically looks for common command-line tools (like 'echo', 'copy', 'type', 'file createnew', 'cacls') combined with the target path 'C:\Windows\Fonts\' and various executable or script file extensions.
This rule detects attempts to interact with Sysmon processes (Sysmon.exe or Sysmon64.exe) with specific access rights (0x1400), which is indicative of the SysmonEnte tool. It also directly looks for the string 'Ente' in the CallTrace, which is a unique identifier for SysmonEnte's activity. The rule filters out legitimate access from common program file locations and Microsoft Defender to reduce false positives.
Detects the creation of specific files within the ProgramData directory that have been observed in campaigns by the Forest Blizzard APT group (also known as Star Blizzard, SEABORGIUM, Callisto Group, TA446, COLDRIVER). These files include those with names like 'prnms003.inf_', 'prnms009.inf_', '.save', 'doit.bat', 'execute.bat', 'servtask.bat', and '.dll' files containing 'wayzgoose', often found in subdirectories under common vendor names within ProgramData.
This rule detects attempts by uncommon processes to access sensitive files associated with Chromium-based browsers. These files typically contain user data such as cookies, browsing history, and web data, which could be leveraged for credential access or other malicious activities if exfiltrated. The rule specifically targets file paths related to Chromium's user profile data and filters out access by common system processes and known legitimate applications like Windows Defender to reduce false positives.
Detects the execution of the Ammyy Admin RMM agent for remote management, specifically when rundll32.exe is used to load and execute the aa_nts.dll component.
Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.
Page 327 of 680