SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,659 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects when the "System.Drawing.ni.dll" library is loaded by a process. This DLL is often used for graphical operations, including screen capturing. Its loading can indicate an attempt to capture screen content, which is a common technique used by adversaries for reconnaissance or data exfiltration.
This rule detects PowerShell scripts that perform potential registry reconnaissance. Specifically, it looks for the use of PowerShell cmdlets like 'Get-Item', 'gci', or 'Get-ChildItem' in conjunction with specific registry paths known to contain system configuration, service information, or autostart entries. Adversaries often query these registry keys to gather information about the system's credentials, configuration, and installed software, which can aid in further compromise or privilege escalation.
This rule detects potentially suspicious child processes spawned by PowerShell. It specifically looks for PowerShell (powershell.exe, powershell_ise.exe, pwsh.exe) launching a set of common Windows utilities that can be abused for malicious purposes, such as 'bitsadmin.exe', 'certutil.exe', 'mshta.exe', 'regsvr32.exe', 'rundll32.exe', 'schtasks.exe', and 'wmic.exe'. The rule includes filters to reduce false positives, such as specific command lines for AWS Workspaces, certutil's '-verifystore' option, and common benign wmic queries.
Detects when an Amazon Simple Email Service (SES) identity is deleted. This action could be performed by an adversary to remove traces of their activities after using the SES identity for malicious purposes, such as sending spam or phishing emails, aligning with defense evasion tactics.
Detects when an AWS EFS (Elastic File System) mount target is deleted. This action can disrupt applications or instances relying on the mounted file system, potentially leading to a denial of service or data unavailability.
Detects when an AWS ElastiCache security group has been created. This action can be used by adversaries to establish persistence or modify network access to ElastiCache resources.
This rule identifies when Azure Firewall Rule Collections (Application, NAT, and Network) are either modified or deleted. This activity can indicate an attempt to bypass network controls, potentially allowing unauthorized access or data exfiltration. Monitoring these operations is crucial for maintaining network security posture in Azure environments.
This rule identifies when an Azure Virtual Network or Virtual Network Gateway is modified or deleted. This activity is captured through Azure Activity Logs, specifically looking for 'MICROSOFT.NETWORK/VIRTUALNETWORKGATEWAYS/' or 'MICROSOFT.NETWORK/VIRTUALNETWORKS/' operations that end with '/WRITE' or '/DELETE'. Such actions can indicate unauthorized changes to network infrastructure, potentially leading to denial of service, network segmentation bypass, or other security incidents.
This rule detects anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser. This indicates a potential compromise of user credentials or an attempt to bypass authentication mechanisms.
Detects when Microsoft Cloud App Security reports suspicious email forwarding rules, such as a user creating an inbox rule to forward copies of all emails to an external address. This activity can indicate an attempt to exfiltrate sensitive information.
Page 491 of 680