SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,679 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the first-time use of a remote named pipe, excluding commonly known legitimate pipes. This can help identify lateral movement and remote execution attempts using named pipes, as adversaries often leverage these for inter-process communication across networked systems.
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory from non-system accounts, which is a common technique used by credential dumping tools like Mimikatz. The rule specifically looks for security events (4663 or 4656) related to process object access with specific access masks targeting 'lsass.exe', while filtering out legitimate system accounts and known benign processes.
Detects the creation of suspicious local accounts that mimic the 'ANONYMOUS LOGON' account, potentially using additional spaces or other obfuscation techniques. This rule specifically targets Event ID 4720 (A security-enabled local group was created) and looks for 'ANONYMOUS' and 'LOGON' within the SamAccountName field, aiming to cover scenarios where such accounts are created to bypass detection or for malicious persistence.
Detects the installation of the NetSupport Manager client service on a Windows system. This rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, and then filters for service paths containing '\NetSupport Manager\client32.exe' or a service name of 'Client32'. This activity can be indicative of legitimate remote administration tool deployment or malicious use for persistence.
Detects suspicious changes to Windows Defender's configuration settings, which could indicate an attempt to disable or impair its protective capabilities. This rule specifically looks for modifications to registry keys related to disabling anti-spyware, removable drive scanning, network drive scanning, cloud-delivered protection (Block at First Seen), and real-time protection reporting.
This rule detects DNS queries for subdomains associated with the MEGA cloud storage service, specifically 'userstorage.mega.co.nz'. Such queries can indicate attempts to exfiltrate data to MEGA, potentially using tools like Rclone, or legitimate usage of the service. The rule focuses on the DNS layer to identify communication with this cloud storage provider.
Detects DNS queries to "ufile.io", which has been observed as a method for data exfiltration by malware and threat actors. This service can be used to upload and share files, making it a convenient target for adversaries to move stolen data out of a compromised network.
Detects the creation of new DLL assembly files by "aspnet_compiler.exe" within the 'Temporary ASP.NET Files' directory, specifically in the 'assembly\tmp\' subdirectory. This activity could indicate abuse of "aspnet_compiler" to proxy execution through a build provider, potentially for malicious purposes.
Detects the creation of specific file artifacts associated with Adwind RAT (also known as jRAT). This includes 'javaw.exe' within the AppData\Roaming\Oracle\bin\java directory and '.vbs' files within a '\Retrive' directory, both known indicators of Adwind/jRAT activity.
Detects the creation of an 'ntds.dit' file, which contains Active Directory database information including credential hashes, by processes commonly abused by attackers or processes running from suspicious directories like 'Temp' or 'AppData'. This activity is highly indicative of credential dumping attempts.
Page 474 of 680