SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,786 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers\" registry key. The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.
Detects when a Kubernetes CronJob or Job is created or modified.
A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule.
An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.
A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule.
An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.
Detects file access requests to the Windows Credential History File by an uncommon application.
This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function
This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function
Detects file access requests to crypto currency files by uncommon processes.
Could indicate potential attempt of crypto currency wallet stealing.
Could indicate potential attempt of crypto currency wallet stealing.
Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.
Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.
Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.
Detects the execution of the SharpDPAPI tool based on command-line flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project, used for extracting credentials and other sensitive information.
This rule detects the execution of 'BrowserCore.exe' when its filename has been changed from the original. Adversaries may rename this legitimate utility, which is known to be used for extracting Azure tokens, to evade detection. The rule specifically looks for processes where the original filename is 'BrowserCore.exe' but the executed image path does not end with '\BrowserCore.exe'.
Detects potential tampering with Windows Defender settings, such as adding exclusions, using the wmic.exe utility. This activity can be indicative of an adversary attempting to impair defenses to avoid detection.
Page 341 of 680