SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,587 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location
Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded
Detects when a all the rules have been deleted from the Windows Defender Firewall configuration
Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit
NTLM Logon
Sigma
Detects logons using NTLM, which could be caused by a legacy source or attackers
Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag".
Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.
Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.
Detects logon events that specify new credentials
Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account.
This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.
This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.
Page 91 of 680