SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,723 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when a user account's User Account Control (UAC) flags are modified to enable weak encryption (DES) or disable Kerberos pre-authentication. This configuration can make the account vulnerable to Kerberoasting attacks, where an attacker can request a service ticket for the user and then offline crack the NTLM hash of the user's password if DES encryption is allowed, or if pre-authentication is disabled.
Detects updates to scheduled tasks (EventID 4702) where the new task content (`TaskContentNew`) contains suspicious keywords. These keywords include common temporary or user-writable directories often used by malware for staging or execution, combined with suspicious commands or scripting interpreters. This rule aims to identify adversaries establishing persistence or executing malicious code via scheduled tasks.
This rule detects attempts to exploit the Zerologon vulnerability (CVE-2020-1472) using tools like Mimikatz or other exploits originating from a machine with 'kali' in its hostname. It specifically looks for Windows System event IDs 5805 or 5723 in conjunction with the keywords 'kali' or 'mimikatz'.
This rule detects the use of Mimikatz by looking for specific keywords associated with its modules and functionalities within Windows Event Logs. These keywords cover various Mimikatz features, including credential dumping (LSASS, SAM, LSA secrets), Kerberos ticket manipulation (golden ticket, pass-the-ticket), DPAPI masterkey extraction, and other miscellaneous functions. Some keywords may be more prevalent in older Mimikatz versions but are still used by threat actors.
This rule detects when the Notepad++ updater utility (GUP.exe) is executed by a process other than Notepad++ itself, specifically when command-line arguments indicate a file download operation (containing '-unzipTo' and 'http'). This behavior can be indicative of an adversary abusing a legitimate application's updater for ingress tool transfer or other malicious file downloads, bypassing typical security controls that might monitor direct download utilities.
Detects the execution of PowerShell commands embedded within a link (.lnk) file. This rule specifically looks for instances where 'explorer.exe' launches 'cmd.exe', and the command line of 'cmd.exe' contains both 'powershell' and '.lnk', indicating an attempt to execute PowerShell via a shortcut file.
Detects the execution of `sqlcmd.exe` with command-line arguments indicative of database enumeration or backup activities, specifically targeting common system databases and processes. This pattern has been associated with Conti ransomware for dumping database contents.
Detects HTTP requests to URIs ending with the ".class" extension. This can indicate attempts to download Java classes, potentially as part of exploitation attacks such as Log4shell against Log4j vulnerabilities. This rule is useful for threat hunting to identify such activities.
Detects potential OGNL Injection exploitation attempts in JVM-based applications, which could lead to Remote Code Execution (RCE). This rule specifically looks for error messages indicating OGNL parsing failures, such as 'org.apache.commons.ognl.OgnlException' or 'ExpressionSyntaxException', which are common indicators when an attacker attempts to inject malicious OGNL expressions. This type of vulnerability has been exploited in high-profile cases like Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134).
This rule identifies 'impossible travel' events where a user's activities originate from geographically distant locations within a time period that is too short for physical travel between those locations. This often indicates a compromised account being accessed from multiple locations simultaneously or in rapid succession, potentially using different IP addresses or devices.
Page 420 of 680