SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,676 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of the 'ntds.dit' file, which contains Active Directory database information, by processes that are not typically associated with this activity. This rule specifically looks for 'ntds.dit' creation when the parent process is an uncommon executable (e.g., cscript.exe, powershell.exe, web server processes) or originates from suspicious directories (e.g., AppData, Temp, Public). This activity often indicates an attempt to dump Active Directory credentials.
Detects the creation of new Office macro files on systems via applications such as web browsers or email clients. This rule identifies files with common Office macro extensions (.docm, .dotm, .xlsm, .xltm, .potm, .pptm) or those with Zone.Identifier streams indicating a download, when created by known browser or email client processes.
This rule detects when common Windows shell and scripting applications (such as bash.exe, cmd.exe, cscript.exe, powershell.exe, certutil.exe, mshta.exe, wmic.exe, etc.) write files to suspicious system folders. The suspicious folders include 'C:\PerfLogs\', 'C:\Users\Public\', and 'C:\Windows\Temp\'. This activity can indicate an adversary attempting to stage or execute malicious payloads in less scrutinized directories for persistence or defense evasion.
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters in filenames. This is used as an obfuscation and masquerading technique. The rule specifically targets "perfect" homoglyphs that are indistinguishable from ASCII characters.
Detects a specific User Account Control (UAC) bypass technique involving the creation of a file named 'comctl32.dll' within a directory structure that starts with 'C:\Windows\System32\consent.exe.@'. This pattern is indicative of UACMe (specifically UACMe 22) attempting to elevate privileges by manipulating how consent.exe loads libraries.
This rule detects the creation of files with specific web-related extensions (.ashx, .asp, .ph, .soap) in common web server directories such as '\inetpub\wwwroot\', '\www\', '\htdocs\', or '\html\'. This activity is often indicative of an attacker uploading a web shell to maintain persistence or execute commands on the compromised web server.
Detects file renames where the target filename uses an uncommon double extension. This behavior is often associated with ransomware activity, where files are encrypted and then renamed with a custom extension, such as ".jpg.crypted" or ".docx.locky". The rule specifically looks for common document and image file extensions followed by another extension, while filtering out known legitimate backup or temporary file extensions.
Detects when an Office application loads the 'kerberos.dll' library. This behavior is unusual for standard Office operations and could indicate an attempt to manipulate Kerberos authentication, potentially for credential access or privilege escalation.
Detects the creation of named pipes commonly used by credential dumping tools such as Mimikatz (wceservicepipe) and other tools that might use 'cachedump' or 'lsadump' in their pipe names to extract credentials.
This rule detects instances where PowerShell is invoked, and there's a mismatch between the PowerShell engine version and the host version. Specifically, it looks for PowerShell classic start events where the 'Data' field contains an 'EngineVersion' of 2, 4, or 5, while simultaneously containing a 'HostVersion' of 3. This version mismatch can indicate attempts to evade detection or exploit vulnerabilities by using an older or specific PowerShell engine version within a newer host environment.
Page 475 of 680