SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,732 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects when a user performs an eDiscovery search or exports a PST file from such a search within Microsoft 365. PST files often contain sensitive information, including email body content, making this activity a potential indicator of data exfiltration or unauthorized access to sensitive communications.
Detects read access to a domain user object from a non-machine account, which can indicate user enumeration activity within Active Directory. The rule specifically looks for Event ID 4662 (An operation was performed on an object) where the ObjectType corresponds to a user object and the AccessMask includes read property permissions. It filters out activity from machine accounts and specific Microsoft Online (MSOL) accounts to reduce false positives.
Detects the execution of 'node.exe' with command-line arguments indicative of arbitrary code execution, specifically looking for evaluation flags ('-e', '--eval') combined with patterns suggesting a reverse shell (e.g., '.exec(', 'net.socket', '.connect', 'child_process'). This behavior has been observed in attacks leveraging vulnerabilities like Log4j.
This rule detects the transfer of sensitive files containing credential data over network shares. It specifically looks for filenames or paths commonly associated with credential dumping, such as 'mimidrv', 'lsass', 'windows\minidump\', 'hiberfil', 'sqldmpr', 'sam', 'ntds.dit', and 'security'. This activity often indicates an attempt to exfiltrate credentials after they have been dumped from a system.
Detects suspicious user agent strings commonly used by various malware families and Remote Access Trojans (RATs) in proxy logs. This rule identifies specific user-agent patterns associated with known threats like DragonOK, PlugX, HTTPBrowser RAT, njRAT, ZeroAccess, Dyre, Upatre, Ghost419, W32/Renos.Downloader, Kazy, Sality, Fareit, Toby web shell, Loki Bot, Pony, MacControl malware, Zebrocy, Ursnif, Emotet, Lockbit, Quasar RAT, Havana, AntSword, Racoon Stealer, AresLoader, Lilith Stealer, SVC Loader, WSHRAT, Zerobot, Nymaim, DarkCloud, BunnyStealer, SparkRAT, B4B3RAT, and Latrodectus loader.
Detects changes to the security group entries for AWS RDS databases. This can indicate a misconfiguration that potentially exposes the database to the public internet, a wider audience within the VPC, or the removal of valid rules which could impact database availability for legitimate services and users. The rule specifically looks for API calls related to authorizing, creating, deleting, or revoking database security group ingress rules.
Detects suspicious error messages from the OpenSSH daemon that may indicate an attempted exploit or a fatal error during an SSH connection attempt. These errors could be triggered by malformed requests or unusual client behavior designed to uncover vulnerabilities or bypass authentication.
Detects Kerberos Ticket-Granting Service (TGS) requests that utilize RC4 encryption. This is often indicative of Kerberoasting attacks, where adversaries request service tickets for Service Principal Names (SPNs) and then attempt to crack the RC4-encrypted hash offline to obtain plaintext credentials. The rule specifically excludes requests from computer accounts (service accounts ending with '$') to reduce false positives.
This rule detects the creation or update of Active Directory Certificate Services (AD CS) certificate templates that include the 'CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT' flag. This flag allows a user to specify the subject name in a certificate request, which can be abused for privilege escalation or credential access, particularly in scenarios involving misconfigured AD CS environments as described in the 'Certified Pre-Owned' research.
This rule detects Mimikatz DCSync activity by monitoring Windows Security Event ID 4662. Specifically, it looks for access attempts to replicate directory changes (identified by specific GUIDs) with an AccessMask of '0x100'. To reduce false positives, it filters out activity from 'Window Manager' and service accounts starting with 'NT AUT', 'MSOL_', or ending with '$'.
Page 406 of 680