SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,622 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects modifications to the Windows Package Manager (winget) administrative settings within the registry. This includes changes that could enable local manifest installations or disable installer hash checks, which might be abused by adversaries for defense evasion or persistence.
This rule detects when the Sysmon configuration is changed. This event (EventID 16) is generated by Sysmon itself when its configuration is updated, which could be a legitimate administrative action to reconfigure Sysmon or an attempt by an adversary to manipulate its monitoring capabilities to evade detection.
Detects when a legitimate system process, identified by its executable path starting with 'C:\Windows\', loads a Dynamic Link Library (DLL) from a suspicious or permissively permissioned location such as 'C:\Users\Public\' or 'C:\PerfLogs\'. This behavior can indicate an attempt to bypass User Account Control (UAC), achieve persistence, or execute malicious code through DLL side-loading or hijacking techniques.
Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.
This rule detects when the `IMEWDBLD.exe` process initiates a network connection. This behavior is suspicious because `IMEWDBLD.exe` is a legitimate Microsoft Windows component (Input Method Editor Word Dictionary Builder) that is not typically expected to make outbound network connections. Adversaries may abuse this utility as a Living Off The Land Binary (LOLBIN) to download additional payloads or exfiltrate data, leveraging its trusted status to evade detection. The detection focuses on the initiation of any network connection by this specific executable.
Detects the creation of a named pipe with the default name '\csexecsvc', which is commonly used by CSExec for remote command execution. This activity is indicative of potential lateral movement or execution of unauthorized code.
This rule detects attempts to enumerate Active Directory groups and user properties using specific PowerShell cmdlets. It looks for the use of 'get-ADPrincipalGroupMembership' to identify group memberships and 'get-aduser' with specific parameters ('-f', '-pr', 'DoesNotRequirePreAuth') which can be used to discover user attributes relevant for privilege escalation or further reconnaissance. This activity is often performed by adversaries to map out the domain environment and identify accounts with elevated privileges.
Detects the initiation of remote PowerShell sessions by identifying specific keywords in the `ContextInfo` field of PowerShell module logs. It looks for the presence of ' = ServerRemoteHost ' and 'wsmprovhost.exe', which are indicative of a remote PowerShell connection. A filter is applied to exclude legitimate PowerShell archive module activity.
This rule detects the execution of the 'Get-NetTCPConnection' PowerShell cmdlet. This cmdlet is used to retrieve information about TCP connections on a system. Adversaries may use this for system network connections discovery to understand the network environment of a compromised host.
Detects code fragments commonly found in small and obfuscated PowerShell scripts designed to bypass Antimalware Scan Interface (AMSI). The rule specifically looks for the combination of '[Ref].Assembly.GetType', 'SetValue($null,$true)', and 'NonPublic,Static' within PowerShell script block text, which are indicative of reflection-based AMSI bypass techniques.
Page 548 of 680