SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,727 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of well-known credential dumping tools by monitoring Windows Security Event ID 4697, which signifies a service creation event. The rule specifically looks for service filenames containing keywords associated with common credential dumping utilities such as 'cachedump', 'dumpsvc', 'fgexec', 'gsecdump', 'mimidrv', 'pwdump', and 'servpw'. This indicates an adversary attempting to install and run a service that can extract credentials from the system.
This rule detects the creation of specific files that are commonly generated by the BloodHound collection tool, SharpHound. These files, such as 'BloodHound.zip', '_computers.json', '_domains.json', '_groups.json', and others, contain collected Active Directory information. The presence of these files on a system indicates that BloodHound or SharpHound has been used for reconnaissance, which is often a precursor to further malicious activity within an Active Directory environment.
Detects the execution of a PowerShell script designed to dump stored credentials from Veeam Backup servers. The script specifically targets the "Veeam.Backup" class and uses `Invoke-Sqlcmd` to extract sensitive information, likely from the Veeam configuration database.
This rule detects attempts to tamper with Windows audit policies using the `auditpol.exe` utility. Threat actors often modify audit policies to impair detection capabilities by disabling, clearing, removing, or restoring specific audit policies, thereby reducing the logging of their malicious activities.
This rule detects attempts to harvest Wi-Fi credentials using the `netsh.exe` utility. Specifically, it looks for `netsh.exe` execution with command-line arguments that indicate an attempt to display WLAN profiles and their keys in clear text, which is a common technique used by malware like Agent Tesla to steal Wi-Fi passwords.
Detects Elise backdoor activity, specifically looking for the creation of a svchost.exe process in a suspicious path and the deletion of a NavShExt.dll file, which are indicators of the Elise malware used by APT32.
Detects exploitation attempts against the Log4j RCE vulnerability (CVE-2021-44228), commonly known as Log4Shell. The rule specifically looks for various JNDI injection patterns within web server log fields such as User-Agent, URI query, and Referer headers, which are common vectors for this vulnerability.
Detects when an end user's consent to an application is blocked by Azure AD due to risk-based consent policies. This indicates that Azure AD has identified a risky application or a risky consent request, preventing the user from granting permissions to it. This can be a proactive measure against consent phishing or malicious applications attempting to gain access to user data.
Detects the removal of packages on Linux systems using common package managers such as 'yum', 'apt', 'apt-get', 'dpkg', and 'rpm'. This activity could be indicative of an adversary attempting to remove forensic artifacts or security tools.
This rule detects the use of the 'touch' command to modify the timestamps of service files. Adversaries may use this technique to make malicious service files appear legitimate or to evade detection by blending them with existing system files. The detection specifically looks for the 'touch' command being executed with the '-t' flag (to set a specific time) and targeting a file ending with '.service'.
Page 416 of 680