SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,538 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory
Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.
Detects the creation of a office macro file from a a suspicious process
Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.
Detects PowerShell creating a PowerShell file (.ps1). While often times this behavior is benign, sometimes it can be a sign of a dropper script trying to achieve persistence.
Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc.
Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShell\Modules\malware\malware.psm1". This is somewhat an uncommon practice as legitimate modules often includes a version folder.
Detects Rclone config files being created
Detects default RemCom service filename which indicates RemCom service installation and execution
Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence
Page 642 of 680