SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,767 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of PingCastle, a legitimate tool used for auditing Active Directory security. Adversaries often leverage such tools during the reconnaissance phase to gather information about the target environment, specifically Active Directory configurations, user accounts, and potential vulnerabilities. The rule identifies PingCastle execution by matching specific MD5, SHA1, and SHA256 hashes of the executable, its original filename, product name, and various command-line arguments associated with its scanning functionalities.
This rule detects when the Windows Filtering Platform (WFP) blocks a network connection initiated by a known Endpoint Detection and Response (EDR) agent binary. Adversaries may manipulate WFP filters to prevent EDR agents from communicating with their command and control servers or reporting security events, thereby impairing defensive capabilities. The rule specifically looks for Event ID 5157 (A Windows Filtering Platform callout blocked a connection) and checks if the `Application` field ends with the executable names of various common EDR products.
Detects when an access level is changed for a Google Workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary could remove access levels to gain easier access to Google Workspace resources, potentially leading to persistence or privilege escalation.
Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
This rule detects the execution of 'tscon.exe' with 'System' integrity level. This combination is indicative of potential RDP session hijacking activity, where an attacker takes over an existing RDP session without needing credentials or prompting the user. The 'tscon.exe' utility is a legitimate Windows tool used to connect to or disconnect from a session on a Remote Desktop Session Host server, but its execution with System integrity is a strong indicator of malicious intent in this context.
Detects the execution of EDRSilencer, a tool that manipulates the Windows Filtering Platform (WFP) to block outbound network traffic from EDR agents. This is identified by monitoring Windows Security Event IDs 5441 (A Windows Filtering Platform filter has been added) or 5447 (A Windows Filtering Platform filter has been changed) in conjunction with the specific filter name 'Custom Outbound Filter' used by EDRSilencer.
Detects an exploitation attempt of CVE-2019-1388, a privilege escalation vulnerability. This involves the UAC consent dialogue (consent.exe) invoking an Internet Explorer process (iexplore.exe) with system-level privileges, indicated by 'System' or 'S-1-16-16384' integrity level and a command line containing ' http'.
Detects when a rule has been modified in the Windows Firewall exception list. This can indicate an adversary attempting to bypass host-based firewall controls to enable command and control, lateral movement, or data exfiltration.
Detects exploitation attempts of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries. The rule specifically looks for child processes spawned by WinRAR.exe, where the command line contains a temporary path indicative of the vulnerability (e.g., '\AppData\Local\Temp\Rar$') and a double extension (e.g., '.ext .exe'), combined with the execution of common binaries like cmd.exe, powershell.exe, or scripting hosts.
Page 373 of 680