SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,723 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious scheduled task creation events by analyzing the task content for unusual paths (e.g., temporary directories, user-writable locations) and the presence of commonly abused command-line utilities or scripting interpreters. This rule aims to identify persistence or execution mechanisms leveraging scheduled tasks.
Detects the installation of a well-known TAP driver service, specifically looking for the 'tap0901' service file name. This activity could indicate preparation for data exfiltration using tunneling techniques, as TAP drivers are often used by VPN software like OpenVPN to create virtual network interfaces.
Detects the creation of local user accounts on Windows servers. In environments utilizing Active Directory, local user creation on member servers is generally an anomalous event and could indicate an adversary establishing persistence or creating backdoor accounts. This rule is specifically designed for Windows server logs and should not be applied to Domain Controller logs, as local user creation on DCs is not applicable.
This rule detects the execution of well-known credential dumping tools by monitoring Windows System event logs for Service Control Manager events (EventID 7045) indicating service creation. The rule specifically looks for service image paths containing keywords associated with common credential dumping utilities such as 'cachedump', 'dumpsvc', 'fgexec', 'gsecdump', 'mimidrv', 'pwdump', and 'servpw'. This helps identify attempts to install and run these tools as services for credential theft.
Detects the use of the built-in Windows utility 'gpresult.exe' with specific command-line arguments ('/z' or '/v') to display detailed Resultant Set of Policy (RSoP) information. This activity can be indicative of an adversary performing discovery to understand the group policy configuration of a system or domain.
Detects the use of the 'reg.exe' utility to delete SafeBoot registry keys. This activity is often performed by attackers to disable security products or interfere with system recovery mechanisms, particularly in the context of defense evasion.
This rule detects attempts to access a webshell that has been dropped into a keystore folder on an Oracle WebLogic server. The detection is based on the URI query containing '*/config/keystore/*.js*', which is indicative of an attacker trying to interact with a webshell placed in a specific directory often associated with the CVE-2018-2894 vulnerability.
This rule detects specific command-line parameters and image paths associated with Mustang Panda droppers. It looks for patterns like 'Temp\wtask.exe /create', specific environment variable manipulations ('%windir:~-3,1%%PUBLIC:~-9,1%', '%windir:~-1,1%'), VBScript execution with file paths containing 'C:\Users\' and '.txt', and the execution of 'Temp\winwsh.exe'. These indicators are characteristic of the dropper stage used by the Mustang Panda APT group.
Detects exploitation attempts against Citrix Netscaler, Application Delivery Controller (ADS), and Citrix Gateway by identifying specific URI query patterns associated with CVE-2020-8193 and CVE-2020-8195.
This rule detects attempts to exploit the Print Spooler vulnerability CVE-2021-1675, also known as PrintNightmare. It specifically looks for Event ID 316 in the Print Service Operational log, which indicates a driver load event. The rule further refines detection by searching for keywords such as 'UNIDRV.DLL, kernelbase.dll,', '123', '1234', or 'mimispool', which are associated with known exploitation methods for this vulnerability. Successful exploitation often involves loading malicious drivers or DLLs through the print spooler service.
Page 428 of 680