SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,698 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects DNS queries to "ufile.io", which has been observed as a method for data exfiltration by malware and threat actors. This rule specifically looks for Event ID 3008 in the Microsoft-Windows-DNS Client Events/Operational log where the QueryName contains 'ufile.io'.
Detects the creation of a local hidden user account on Windows systems. Hidden accounts are often indicated by a dollar sign ($) at the end of the username and can be used by adversaries for persistence.
This rule detects attempts by non-system users to obtain a handle to the Service Control Manager (SCM) database, specifically targeting the 'ServicesActive' object with a broad access mask (0xf003f). This activity can indicate an adversary attempting to enumerate or manipulate services on a Windows system.
Detects a user log-off activity. This rule can be used to correlate information during forensic investigations by identifying when a user session ends. It specifically looks for Windows Event IDs 4634 (An account was logged off) and 4647 (User initiated logoff).
Detects various Windows Update errors, including failures to connect to the update service, installation failures, uninstallation failures, revert failures, and commit failures. Monitoring these events is crucial to ensure that critical security updates are being successfully applied to systems. Persistent errors could indicate issues with network connectivity, compromised update services, or attempts to prevent system patching, which could leave systems vulnerable to known exploits.
Detects suspicious WMI event filter and command line event consumer creation or modification based on WMI and Security Logs. This rule specifically looks for EventID 5861 (WMI filter to consumer binding) and EventID 5859 (WMI filter registration) in conjunction with common consumer keywords like 'ActiveScriptEventConsumer' and 'CommandLineEventConsumer'. It excludes legitimate SCM Event Provider activity.
Detects the creation of a remote thread by 'Ttdinject.exe', which can be abused as a proxy to execute malicious code. This technique is often used for defense evasion.
This rule detects DNS queries made by the Azure Hybrid Connection Manager service to the Azure Service Bus service. This activity is considered suspicious because it could indicate an attempt to establish persistence or exfiltrate data through a compromised Hybrid Connection Manager, leveraging the Service Bus as a communication channel.
This rule detects the deletion of TeamViewer log files. Adversaries may delete these logs to remove forensic evidence of their activity, making it harder to trace their actions or identify their presence on a system. The rule specifically looks for file deletion events where the target filename contains "\TeamViewer_" and ends with ".log", while excluding deletions performed by 'C:\Windows\system32\svchost.exe' to reduce false positives.
Detects the deletion of Apache Tomcat web server logs, which could indicate an adversary attempting to remove forensic evidence of their activities on the server. The rule specifically looks for deletion events targeting files within paths containing '\Tomcat\logs\' and filenames matching common Tomcat log patterns like 'catalina.', '_access_log.', or 'localhost.'.
Page 459 of 680