SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,720 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
ISO Image Mounted
Sigma
This rule detects when an ISO image is mounted on a Windows endpoint. It specifically looks for Event ID 4663 (An attempt was made to access an object) where the ObjectServer is 'Security', ObjectType is 'File', and the ObjectName starts with '\Device\CdRom'. The rule filters out common legitimate files found on mounted ISOs, such as 'autorun.ico', 'setup.exe', and 'setup64.exe', to reduce false positives. This activity can be indicative of an adversary using ISO images to bypass Mark-of-the-Web (MOTW) protections and deliver malicious payloads.
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory with specific access rights (0x705) and an object type of 'SAM_DOMAIN'. This activity is indicative of tools or techniques used to dump credentials from LSASS, a common method for adversaries to obtain user credentials.
Detects the use of NTLMv1 for authentication between a client and server. NTLMv1 is an insecure authentication protocol due to its susceptibility to brute-force attacks against its underlying encryption algorithms. This rule identifies events logged by the LsaSrv provider indicating NTLMv1 usage.
Detects non-standard tools initiating outbound connections over port 3389, which is commonly used for Remote Desktop Protocol (RDP). This activity can indicate possible lateral movement within a network. The rule filters out legitimate RDP clients and other known third-party tools to reduce false positives. An initial baseline of legitimate RDP tooling is required for effective use.
This rule detects the presence of keywords commonly associated with well-known PowerShell exploitation frameworks such as Mimikatz and Metasploit within PowerShell script blocks. The keywords indicate attempts to perform privileged operations like manipulating access tokens, reading process memory, or other actions typically involved in credential dumping and privilege escalation. Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware. Specifically, it looks for commands that disable boot status policy to ignore all failures and disable recovery enabled.
Detects the execution of TTDInject.exe, a legitimate Windows utility used for time travel debugging. This tool can be abused for proxy execution of malicious payloads, bypassing application control solutions.
This rule detects PowerShell execution where the command line contains Base64 encoded strings that decode to 'Invoke-' keywords. It specifically looks for both UTF-8 and UTF-16 Little Endian (LE) encodings of 'Invoke-' when PowerShell or pwsh.exe is executed with the '-e' (encoded command) flag. This technique is commonly used by adversaries to obfuscate malicious PowerShell commands.
Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward. The detection relies on the presence of 'FromBase64String' for decoding, 'MemoryStream' for in-memory operations, and 'H4sI' which is a common magic string for Gzip compressed data.
Detects when a process attempts to add or modify a network provider by manipulating the Windows Registry, specifically targeting the 'NetworkProvider' key within 'System\CurrentControlSet\Services\'. This activity is indicative of potential credential dumping attempts, similar to techniques used by tools like NPPSpy, which can register a malicious network provider DLL to capture cleartext credentials during the authentication process.
Page 431 of 680