SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,670 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects when the deployment of an AppX package is blocked by the local computer policy. This can indicate an attempt to install an unauthorized application that is being prevented by system controls. The rule specifically looks for EventIDs 441, 442, 453, and 454 from the Microsoft-Windows-AppXDeployment-Server event source.
This rule detects events where Windows Code Integrity blocks a file because it is disallowed for protected processes. This indicates an attempt to load or execute an unauthorized file within a protected process environment, which could be a sign of privilege escalation or an attempt to bypass security controls.
Detects reconnaissance activities targeting privileged Active Directory users or groups by monitoring Windows Security Event ID 4661. The rule specifically looks for access attempts to objects identified as privileged users or groups based on their Security Identifier (SID) suffixes or names containing 'admin'. It filters out activity from machine accounts to reduce false positives.
Detects attempts to modify the Discretionary Access Control List (DACL) of Active Directory objects, specifically looking for WRITE_DAC access (0x40000). This can indicate an adversary attempting to gain control over Active Directory objects, potentially for privilege escalation or persistence.
Detects the creation of a new service where the service file name contains patterns indicative of using `clip.exe` or similar clipboard-related utilities, often associated with obfuscated PowerShell scripts. This can be a technique used for defense evasion by adversaries.
This rule detects the creation of a new Windows service where the service executable path contains 'powershell' or 'pwsh'. This behavior is often indicative of an adversary attempting to establish persistence or elevate privileges by running PowerShell scripts as a service.
This rule detects a potential Kerberos Replay Attack on domain controllers. It specifically looks for Event ID 4649, which indicates that a "KRB_AP_ERR_REPEAT" Kerberos response was sent to the client. This error signifies that the KDC detected a replay of a Kerberos Application Server (AP) request, suggesting an adversary might be attempting to reuse stolen Kerberos tickets to gain unauthorized access.
Detects attempts to request a handle to the Security Account Manager (SAM) registry hive. Accessing the SAM hive can indicate an adversary attempting to dump credentials.
Detects when important scheduled tasks are deleted or disabled. Adversaries may delete or disable scheduled tasks to hinder defensive capabilities, stop legitimate services, or prevent forensic analysis. This rule specifically targets tasks related to system restore, Windows Defender, BitLocker, Windows Backup, and Windows Update, which are critical for system integrity and security.
This rule detects the mounting of a volume shadow copy, specifically looking for Event ID 98 from the Microsoft-Windows-Ntfs provider where the DeviceName contains 'HarddiskVolumeShadowCopy'. Adversaries may mount volume shadow copies to access files, including credential stores like the Security Account Manager (SAM) database, without directly interacting with the live file system, which can bypass some security controls.
Page 484 of 680