SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,644 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects when an application has been uninstalled from a Windows system. It specifically looks for MsiInstaller events with EventIDs 1034 (Windows Installer removed the product) or 11724 (Product Removal Successful). This can be an indicator of an adversary attempting to remove security software or other critical applications to hinder detection or response efforts, or simply to clean up their tracks.
Detects the execution of AppX packages that have been signed with a known suspicious or malicious digital certificate. Specifically, this rule targets certificates issued to 'Foresee Consulting Inc.', which has been associated with malicious activity. This detection helps identify potentially unwanted or malicious applications attempting to run on a Windows system by leveraging compromised or misused digital signatures.
Detects DNS queries for 'anonfiles.com', which is an anonymous file upload platform frequently used for malicious purposes, including data exfiltration by malware such as BlackByte ransomware. This rule specifically looks for Event ID 3008 from the Microsoft-Windows-DNS Client Operational log, indicating a DNS query for a domain containing '.anonfiles.com'.
Detects when settings of the Windows firewall have been changed, indicated by specific Event IDs from the Windows Defender Firewall with Advanced Security log. This can be an indicator of an adversary attempting to bypass network controls.
This rule detects successful logon events (EventID 4624) where the LogonType is 9, which signifies a new credentials logon. This logon type is typically associated with the 'RunAs' command or similar functionality, where a user explicitly provides alternate credentials to execute a program or access a resource. Adversaries may use this technique to execute code with different user privileges or to move laterally within an environment using stolen or compromised credentials.
This rule detects suspicious access attempts to the registry key associated with the Azure AD Health monitoring agent. It specifically looks for Event IDs 4656 (handle to an object was requested) or 4663 (an attempt was made to access an object) on the registry key '\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent'. The rule filters out access attempts made by legitimate Azure AD Health monitoring agent processes to reduce false positives. This detection requires specific SACL auditing to be configured on the registry key.
Detects successful logon attempts that occur via the Windows Management Instrumentation (WMI) service, specifically when the WmiPrvSE.exe process is involved. This can indicate an adversary using WMI for execution or lateral movement.
Detects obfuscated PowerShell commands being executed via standard input (stdin) by monitoring Windows Security Event ID 4697. The rule looks for specific keywords like 'set', '&&', 'environment', 'invoke', and '${input)' within the ServiceFileName field, which can indicate attempts to bypass detection by passing obfuscated scripts or commands directly to PowerShell.
Detects obfuscated use of stdin to execute PowerShell commands, specifically looking for the creation of a service with a command line containing 'cmd', 'powershell', input redirection ('${input}'), 'noexit', and command execution flags (' /c ', ' /r '). This pattern is indicative of techniques used by tools like Invoke-Obfuscation to hide malicious PowerShell execution.
Detects obfuscated use of environment variables to execute PowerShell commands. This technique is often used by adversaries to evade detection by security products. The rule specifically looks for the creation of a service with a command-line containing 'cmd', 'set', '-f', and either '/c' or '/r', which are indicative of a PowerShell command being constructed and executed via environment variables.
Page 504 of 680