SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,739 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE, also known as BlueKeep. The detection specifically looks for failed RDP login attempts (EventID 4625) with a TargetUserName of 'AAAAAAA', which is a known signature of this scanner.
Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675, also known as PrintNightmare. The rule specifically looks for EventID 808 with ErrorCode 0x45A or 0x7e, combined with keywords indicating a plug-in module load failure and common DLL names used in PrintNightmare Proof-of-Concept exploits.
Detects suspicious DLL loads by the Windows Print Spooler service from its backup driver folders. This behavior is indicative of exploitation attempts related to vulnerabilities like PrintNightmare (CVE-2021-1675, CVE-2021-34527) where an attacker can force the spooler service to load arbitrary DLLs, leading to privilege escalation or remote code execution.
Detects specific process creation patterns associated with UNC2452 (SolarWinds Compromise) activity, as identified by Microsoft Defender ATP queries. This includes the use of 7-Zip for archiving, wscript.exe executing VBS scripts, and rundll32.exe for DLL execution, often involving specific command-line arguments and parent-child relationships.
This rule detects suspicious errors related to the Remote Desktop Protocol (RDP) that could indicate an attempt to exploit CVE-2019-0708, also known as BlueKeep. It specifically looks for Event IDs 56 or 50 generated by the 'TermDD' provider, which are associated with RDP session errors that can occur during exploitation attempts.
This rule detects attempts to exploit the PrintNightmare vulnerability (CVE-2021-1675) by monitoring for DLL deletions within the Windows Spooler Service driver folder. Specifically, it looks for `spoolsv.exe` deleting files in `C:\Windows\System32\spool\drivers\x64\3\`, which is a common indicator of this exploit.
Detects the creation of files that resemble exports of the local Security Account Manager (SAM) database. This activity is often associated with credential dumping techniques used by adversaries to obtain local user hashes. The rule specifically looks for common filenames and paths used when dumping the SAM hive, including those related to known exploits like CVE-2021-36934 and tools like ShadowSteal and hivenightmare.
Detects suspicious rejected SMB guest logon attempts from an IP address, which can be an indicator of an attempted PrintNightmare (CVE-2021-1675) remote code execution exploit or other brute-force/password guessing attacks against SMB. The rule specifically looks for EventID 31017 (SMB client security event for rejected guest logon) where the UserName is empty and the ServerName starts with '\1', which is often seen in exploit attempts.
Detects the use of a Proof-of-Concept (PoC) tool designed to exploit the Local Privilege Escalation (LPE) vulnerability CVE-2021-41379. The rule specifically looks for MsiInstaller Event ID 1033 with the data containing 'test pkg', which is indicative of the PoC's activity.
Detects signs of the exploitation of Local Privilege Escalation (LPE) vulnerability CVE-2021-41379. This specific rule identifies the creation of an 'elevation_service.exe' file by 'msiexec.exe' within the Microsoft Edge application directory, which is a known indicator of this exploit.
Page 395 of 680