SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,769 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects file access requests to browser credential stores by uncommon processes. This could indicate a potential attempt at credential stealing. This rule requires heavy baselining before usage.
Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is trying to print/save a registry key as a PDF in order to potentially extract sensitive information and bypass defenses.
Detects attempts to access the "unattend.xml" file, which can contain sensitive credentials used during the unattended Windows installation process. Attackers may target this file to harvest credentials.
Detects Microsoft Word loading an Add-In (.wll) file, which can be used by threat actors for initial access or persistence. This rule specifically looks for the 'ImageLoaded' event where the loaded file has a '.wll' extension and the 'Image' (process) is 'winword.exe'.
Detects an initiated network connection by a non-browser process on the system to "azurewebsites.net". This domain has been frequently used by threat actors for malware hosting and data exfiltration. The rule filters out connections made by common web browsers and other legitimate applications to reduce false positives.
This rule detects the execution of the BOINC client binary when it has been renamed from its original filename 'BOINC.exe'. Adversaries may rename legitimate binaries to evade detection, often as part of defense evasion tactics. This specific detection looks for processes where the original filename is 'BOINC.exe' but the executed image path does not end with '\BOINC.exe'.
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Detects the creation of processes where the image name ends with '.exe' but the full path is missing or malformed, indicating an attempt to evade image-based detections. This can be used by adversaries to masquerade malicious processes.
This rule detects the execution of the Microsoft Teams application when its executable file has been renamed. Adversaries may rename legitimate application binaries to evade detection mechanisms that look for specific file names or paths. The rule specifically looks for processes where the original file name (as embedded in the executable metadata) is 'msteams.exe' or 'teams.exe', but the actual executed image path does not end with these legitimate names, indicating a renaming activity.
Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.
Page 328 of 680