SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,760 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potential exploitation attempts of the Netlogon Elevation of Privilege Vulnerability (CVE-2020-1472), also known as Zerologon. This rule specifically looks for Event ID 4742 (A computer account was changed) where the SubjectUserName is 'ANONYMOUS LOGON' and the TargetUserName matches a Domain Controller's machine account name (ending with '$'), while filtering out legitimate password changes by checking if 'PasswordLastSet' is not '-'.
Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms.
Detects the execution of the "cloudflared" tool with command-line arguments indicative of establishing or running a tunnel. This activity has been observed in post-compromise scenarios by threat actors, such as the Akira ransomware group, to maintain persistence and remote access to compromised networks by creating covert communication channels.
Detects the use of 'tail' to extract bytes at an offset from an image file (e.g., JPEG, PNG) and then pipe the output to 'base64 --decode' to create a new file with the decoded content. This technique is often used by adversaries to deobfuscate or extract hidden payloads from seemingly innocuous image files, typically executed as a bash one-liner.
Detects the execution of the Cloudflared Quick Tunnel utility, which can be used by adversaries to establish tunnels for various services like HTTP, RDP, SSH, and SMB. This tool has been observed in use by threat groups, including Akira ransomware, to create ad-hoc tunnels that generate random subdomains on trycloudflare.com.
Detects the creation of a file with an ".rdp" extension by applications that are not typically expected to create such files, such as web browsers, email clients, and chat applications. This can indicate an attempt to deliver a malicious RDP file to a user, potentially leading to initial access or defense evasion.
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process with suspicious access masks. Adversaries often target LSASS to dump credentials for lateral movement or privilege escalation. The rule looks for specific access mask values in Windows Security Event IDs 4656 (handle requested) and 4663 (object access attempt) that are indicative of credential dumping activities, while filtering out known legitimate processes.
Detects file access requests to the Windows Sysvol Policies Share by processes that are not commonly expected to interact with these files. This could indicate an adversary attempting to discover or exploit Group Policy Preferences for credential access or other malicious purposes.
Detects the creation of named pipes with patterns characteristic of the EfsPotato privilege escalation tool. This tool exploits a vulnerability related to the Encrypting File System (EFS) service to achieve local privilege escalation by creating specific named pipes for inter-process communication.
This rule detects the execution of the 'cloudflared' binary when it has been renamed. It looks for specific command-line arguments associated with Cloudflare Tunnel operations ('tunnel cleanup', 'tunnel run', '-url tunnel') in conjunction with a list of known SHA256 hashes for legitimate cloudflared executables. The rule triggers if these conditions are met and the executable's name is NOT one of the known legitimate 'cloudflared.exe' names, indicating a potential attempt to disguise its execution.
Page 384 of 680