SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,706 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the installation of an Exchange Transport Agent. Transport agents are .NET assemblies that can operate on email messages passing through the Exchange transport pipeline. Adversaries may abuse this functionality to establish persistence, intercept emails, or exfiltrate data.
Detects the creation or removal of a computer account in Active Directory. This can be indicative of attacks such as DCShadow, which involves registering a rogue Domain Controller to manipulate Active Directory data. The rule specifically looks for Windows Security Event IDs 4741 (A computer account was created) and 4743 (A computer account was deleted).
Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed. It is recommended to turn off "Local Group Policy Object Processing" via GPO to ensure Active Directory GPOs take precedence over local/edited computer policies.
Detects the creation or renaming of a user account with a '$' character in its name. This technique can be used by adversaries to hide user accounts or evade detection systems that may not properly parse or display such characters, making the account appear less conspicuous or legitimate.
This rule detects the installation of packet capture (pcap) drivers on Windows systems by monitoring Event ID 4697 (A service was installed in the system). The detection logic specifically looks for common filenames associated with pcap drivers such as 'pcap', 'npcap', 'npf', 'nm3', 'ndiscap', 'nmnt', 'windivert', 'USBPcap', and 'pktmon' within the ServiceFileName field. The installation of such drivers can indicate an adversary's attempt to perform network sniffing.
Detects the installation of suspicious applications by monitoring the Windows Shell-Core event log for EventID 28115, which indicates a shortcut being added to the app resolver cache. The rule specifically looks for known suspicious application names like Zenmap, AnyDesk, Wireshark, and OpenVPN in the 'Name' or 'AppID' fields.
Detects the installation of the 'RTCore64' service, which is associated with Micro-Star MSI Afterburner. This service can be abused by attackers to load vulnerable drivers, a technique often referred to as 'Bring Your Own Vulnerable Driver' (BYOVD) for privilege escalation or defense evasion.
Detects the creation of a suspicious Alternate Data Stream (ADS) file, specifically a ':Zone.Identifier' stream, by processes other than common web browsers. The ':Zone.Identifier' ADS is used by Windows to mark files downloaded from the internet, indicating their origin and often triggering security warnings. This rule looks for the creation of this ADS with a 'ZoneId=3' (indicating an internet origin) on executable or document file types. By filtering out known browser processes, the rule aims to identify instances where other applications or scripts might be creating these ADS files, potentially as a defense evasion technique to bypass security warnings or to masquerade malicious files.
This rule detects when a driver is loaded from a temporary directory. Adversaries may load malicious drivers from temporary locations as part of persistence, privilege escalation, or defense evasion techniques. Loading drivers from temporary directories is often an unusual behavior for legitimate system operations and can indicate suspicious activity.
This rule detects the creation of new text files (.txt) within a user's Desktop directory by the 'cmd.exe' process. This behavior is often associated with ransomware dropping ransom notes or other instructional files after encrypting data.
Page 454 of 680