SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,786 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of the AdFind.exe utility, which is commonly used for reconnaissance in Active Directory environments. The rule identifies AdFind.exe by its image name, original filename, and specific IMPHASH values.
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
This rule detects the execution and usage of the DSInternals PowerShell module. DSInternals is a powerful tool that exposes internal features of Active Directory and Azure Active Directory, enabling actions such as dumping DPAPI backup keys, manipulating NTDS.DIT files, auditing FIDO2 and NGC keys, performing password auditing, and recovering Domain Controllers from IFM backups. The rule specifically looks for a wide range of DSInternals cmdlets being executed via the command line.
Detects changes to the HypervisorEnforcedCodeIntegrity registry key where the "Enabled" value is set to 0, which disables the Hypervisor Enforced Code Integrity (HVCI) feature. Disabling HVCI allows an attacker to load unsigned and untrusted code into the kernel, potentially facilitating privilege escalation or defense evasion.
Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns
Detects the execution of the CSharp interactive console (csi.exe) when it is spawned by PowerShell. This activity can be indicative of an adversary leveraging trusted developer utilities for proxy execution, potentially to bypass application controls or execute malicious code.
Detects outbound network connections initiated by `dialer.exe`, an outdated Microsoft utility. This process is known to be targeted by info-stealers for process injection and used to establish command and control (C2) connections, with Rhadamanthys being a common example. The rule filters out connections to common local and private IP ranges to reduce false positives.
Detects the execution and usage of the DSInternals PowerShell module. This module can be used to perform suspicious activities such as dumping DPAPI backup keys, manipulating NTDS.DIT files, auditing FIDO2 and NGC keys, performing password auditing, recovering domain controllers from IFM backups, and calculating password hashes. The rule specifically looks for a wide range of cmdlets associated with the DSInternals module within PowerShell script block logs.
Detects the enabling of the "EnablePeriodicBackup" registry value. Once enabled, The OS will backup System registry hives on restarts to the "C:\Windows\System32\config\RegBack" folder. Windows creates a "RegIdleBackup" task to manage subsequent backups. Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803". Adversaries might enable this feature to collect system registry hives, which can contain sensitive information.
Detects outbound network connections initiated by msbuild.exe to common C2 ports (80, 443), which could indicate the use of Silenttrinity or other MSBuild-based execution for command and control.
Page 342 of 680