SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,696 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of PowerShell to add Exchange snap-ins and potentially export mailbox data. This activity has been observed in attacks by threat groups such as HAFNIUM and APT27, often as part of post-exploitation to collect sensitive information from Exchange servers.
Detects suspicious PowerShell invocations using partial parameter names for common obfuscation techniques. This rule specifically looks for truncated forms of parameters like '-windowstyle hidden', '-NoProfile', '-NonInteractive', '-EncodedCommand', and '-ExecutionPolicy Bypass', which are frequently used by adversaries to hide their activity or bypass security measures.
This rule detects the execution of the legitimate tool 'Mouse Lock' based on its product name, company name, or command line arguments. According to Kaspersky's 2020 Incident Response Analyst Report, this tool has been observed being used by adversaries for credential access and data collection in security incidents, making it a potentially unwanted application (PUA) in a security context.
Detects the registration of a debugger for a program that is available in the logon screen, commonly known as a sticky key backdoor. This technique involves modifying the Image File Execution Options (IFEO) registry key to launch an arbitrary executable (debugger) when a legitimate accessibility program (like sethc.exe or utilman.exe) is invoked from the logon screen. This can be used for persistence and privilege escalation to gain SYSTEM privileges.
Detects 'svchost.exe' spawning 'rundll32.exe' with command arguments like 'C:\windows\system32\davclnt.dll,DavSetCookie'. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).
Detects suspicious process patterns indicative of NTDS.DIT exfiltration attempts. This includes the use of specific tools like NTDSDumpEx, PowerShell scripts (e.g., NTDSgrab.ps1), and command-line utilities (ntdsutil.exe, copy command) to access or copy the ntds.dit file. The rule also looks for these activities originating from suspicious image folders like Apache, Tomcat, AppData, Temp, Public, or PerfLogs.
Detects potential PowerShell execution from a DLL instead of the usual PowerShell process, as seen used in PowerShdll. This detection assumes that PowerShell commands are passed via the CommandLine.
This rule detects the execution of the `takeown.exe` utility with the `/f` (force) and `/r` (recursive) flags. Adversaries may use `takeown.exe` to gain ownership of files or directories, especially when combined with recursive operations, to bypass access controls and modify permissions. This action can be a precursor to further malicious activities such as modifying system files, installing persistence mechanisms, or exfiltrating data.
Detects the installation of the Azure Hybrid Connection Manager service by monitoring registry modifications. This service can be used to allow remote code execution from Azure functions, potentially as a method for adversaries to establish persistence or facilitate further access.
This rule detects attempts to exploit CVE-2019-3398, a path traversal vulnerability in Confluence. The detection logic specifically looks for HTTP POST requests to '/upload.action' containing the path traversal sequence 'filename=../../../../'. This pattern indicates an attempt to upload a file to an arbitrary location on the server, which is characteristic of the CVE-2019-3398 exploitation.
Page 461 of 680