SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,781 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects attempts to delete Windows Volume Shadow Copies using PowerShell commands that interact with WMI (Windows Management Instrumentation). Specifically, it looks for PowerShell scripts containing `Get-WmiObject`, `gwmi`, `Get-CimInstance`, or `gcim` in conjunction with `Win32_ShadowCopy` and a deletion method like `.Delete()`, `Remove-WmiObject`, `rwmi`, `Remove-CimInstance`, or `rcim`. This technique is commonly employed by ransomware families, such as Sodinokibi/REvil, to prevent system recovery.
Detects the creation of new pods within the `kube-system` namespace. This activity is suspicious because attackers might create pods with names similar to legitimate system components (e.g., `kube-proxy-bv61v`) to masquerade as system pods and evade detection. Legitimate system pods created by controllers typically have random suffixes in their names. This rule specifically looks for `create` operations on `pods` within the `kube-system` namespace.
Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.
Detects Active Directory enumeration activity using the AdFind tool with specific command-line flags to discover password policies, enumerate Active Directory administrators, or enumerate Exchange AD objects. This activity is often associated with reconnaissance phases of an attack.
Detects Kapeka backdoor process execution pattern, where the dropper launches the backdoor binary by calling rundll32.exe and passing the backdoor's first export ordinal (#1) with a "-d" argument. The rule specifically looks for rundll32.exe executing a .wll file from common temporary or application data directories like ProgramData or AppData\Local, combined with the ordinal #1 and a "-d" argument.
This rule detects attempts to proxy web pages through the HTTPPROXY service on an OpenCanary honeypot. This indicates that an attacker or automated tool has interacted with the honeypot's HTTP proxy, potentially attempting to use it for further malicious activity or reconnaissance.
Detects uncommon outbound network activity via Kerberos default port (88) indicating possible lateral movement or initial privilege escalation through delegation. The rule specifically filters out common legitimate processes like LSASS, Chrome, Firefox, and Tomcat that might generate similar network activity, aiming to reduce false positives.
Detects an attempt to leverage dnscmd.exe to enumerate DNS zones or records of a domain. This activity can be indicative of reconnaissance by an attacker.
Detects an attacker trying to enable the Outlook security setting "EnableUnsafeClientMailRules" which allows Outlook to run applications or execute macros. This setting can be manipulated via the command line, typically through registry modification commands.
Detects the creation of files with specific naming patterns and paths commonly used by the post-exploitation tool CrackMapExec. This includes PowerShell scripts like 'temp.ps1' and 'msol.ps1' in the 'C:\Windows\Temp\' directory, as well as temporary files with UUID-like or 8-character alphanumeric names.
Page 340 of 680