Rule Library

Sigma Rules

3,332 rules found

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionlowtest

Windows Firewall Settings Have Been Changed

Detects activity when the settings of the Windows firewall have been changed

Windowsfirewall-as
TA0005 · Defense EvasionT1562.004 · Disable or Modify System Firewall
François Hubaut+1Sat Feb 19windows
Detectionmediumtest

ETW Logging/Processing Option Disabled On IIS Server

Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.

Windowsiis-configuration
TA0005 · Defense EvasionTA0003 · PersistenceT1562.002 · Disable Windows Event LoggingT1505.004 · IIS Components
François Hubaut+1Sun Oct 06windows
Detectionhightest

HTTP Logging Disabled On IIS Server

Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.

Windowsiis-configuration
TA0005 · Defense EvasionTA0003 · PersistenceT1562.002 · Disable Windows Event LoggingT1505.004 · IIS Components
François HubautSun Oct 06windows
Detectionmediumtest

New Module Module Added To IIS Server

Detects the addition of a new module to an IIS server.

Windowsiis-configuration
TA0005 · Defense EvasionTA0003 · PersistenceT1562.002 · Disable Windows Event LoggingT1505.004 · IIS Components
François HubautSun Oct 06windows
Detectionlowtest

Previously Installed IIS Module Was Removed

Detects the removal of a previously installed IIS module.

Windowsiis-configuration
TA0005 · Defense EvasionTA0003 · PersistenceT1562.002 · Disable Windows Event LoggingT1505.004 · IIS Components
Nasreddine Bencherchali (Nextron Systems)Sun Oct 06windows
Detectionmediumtest

Potential Active Directory Reconnaissance/Enumeration Via LDAP

Detects potential Active Directory enumeration via LDAP

Windowsldap
TA0007 · DiscoveryT1069.002 · Domain GroupsT1087.002 · Domain AccountT1482 · Domain Trust Discovery
Adeem MawaniTue Jun 22windows
Detectionmediumtest

Standard User In High Privileged Group

Detect standard users login that are part of high privileged groups such as the Administrator group

Windowslsa-server
TA0006 · Credential AccessTA0004 · Privilege Escalation
François HubautFri Jan 13windows
Detectioncriticaltest

ProxyLogon MSExchange OabVirtualDirectory

Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory

Windowsmsexchange-management
T1587.001 · MalwareTA0042 · Resource Development
Florian Roth (Nextron Systems)Mon Aug 09windows
Detectioncriticaltest

Certificate Request Export to Exchange Webserver

Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell

Windowsmsexchange-management
TA0003 · PersistenceT1505.003 · Web Shell
Max Altgelt (Nextron Systems)Mon Aug 23windows
Detectioncriticaltest

Mailbox Export to Exchange Webserver

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

Windowsmsexchange-management
TA0003 · PersistenceT1505.003 · Web Shell
Florian Roth (Nextron Systems)+2Mon Aug 09windows
Detectionhightest

Remove Exported Mailbox from Exchange Webserver

Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit

Windowsmsexchange-management
TA0005 · Defense EvasionT1070 · Indicator Removal
Christian Burkard (Nextron Systems)Fri Aug 27windows
Detectionhightest

Exchange Set OabVirtualDirectory ExternalUrl Property

Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log

Windowsmsexchange-management
TA0003 · PersistenceT1505.003 · Web Shell
Jose RodriguezMon Mar 15windows
Detectionmediumtest

MSExchange Transport Agent Installation - Builtin

Detects the Installation of a Exchange Transport Agent

Windowsmsexchange-management
TA0003 · PersistenceT1505.002 · Transport Agent
Tobias MichalskiTue Jun 08windows
Detectionhightest

Failed MSExchange Transport Agent Installation

Detects a failed installation of a Exchange Transport Agent

Windowsmsexchange-management
TA0003 · PersistenceT1505.002 · Transport Agent
Tobias MichalskiTue Jun 08windows
Detectionlowtest

NTLM Logon

Detects logons using NTLM, which could be caused by a legacy source or attackers

Windowsntlm
TA0005 · Defense EvasionTA0008 · Lateral MovementT1550.002 · Pass the Hash
Florian Roth (Nextron Systems)Fri Jun 08windows
Detectionmediumtest

NTLM Brute Force

Detects common NTLM brute force device names

Windowsntlm
TA0006 · Credential AccessT1110 · Brute Force
Jerry ShockleyWed Feb 02windows
Detectionmediumtest

Potential Remote Desktop Connection to Non-Domain Host

Detects logons using NTLM to hosts that are potentially not part of the domain.

Windowsntlm
TA0011 · Command and Controlattack.t1219.002
James PembertonFri May 22windows
Detectionmediumtest

OpenSSH Server Listening On Socket

Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.

Windowsopenssh
TA0008 · Lateral MovementT1021.004 · SSH
mdecrevoisierTue Oct 25windows
Detectionmediumtest

Potential Access Token Abuse

Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag".

Windowssecurity
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1134.001 · Token Impersonation/Theftstp.4u
Michaela Adams+1Sun Nov 06windows
Detectionlowtest

Admin User Remote Logon

Detect remote login by Administrator user (depending on internal pattern).

Windowssecurity
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionTA0008 · Lateral Movement+5
juju4Sun Oct 29windows
Detectioncriticaltest

DiagTrackEoP Default Login Username

Detects the default "UserName" used by the DiagTrackEoP POC

Windowssecurity
TA0004 · Privilege Escalation
Nasreddine Bencherchali (Nextron Systems)Wed Aug 03windows
Detectionhightest

Successful Overpass the Hash Attempt

Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.

Windowssecurity
TA0005 · Defense EvasionTA0008 · Lateral MovementS0002 · MimikatzT1550.002 · Pass the Hash
Roberto Rodriguez (Cyb3rWard0g)+1Mon Feb 12windows
Detectionhightest

RDP Login from Localhost

RDP login with localhost source address may be a tunnelled login

Windowssecurity
TA0008 · Lateral Movement2013-07-002 · CAR 2013-07-002T1021.001 · Remote Desktop Protocol
Thomas PatzkeMon Jan 28windows
Detectionmediumtest

External Remote RDP Logon from Public IP

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Windowssecurity
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionTA0001 · Initial Access+4
Micah Babinski+1Thu Jan 19windows
Detectionhightest

External Remote SMB Logon from Public IP

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Windowssecurity
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionTA0001 · Initial Access+4
Micah Babinski+1Thu Jan 19windows
Detectionmediumtest

Failed Logon From Public IP

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

Windowssecurity
TA0004 · Privilege EscalationTA0005 · Defense EvasionTA0001 · Initial AccessTA0003 · Persistence+3
NVISOWed May 06windows
Detectionlowtest

Outgoing Logon with New Credentials

Detects logon events that specify new credentials

Windowssecurity
TA0005 · Defense EvasionTA0008 · Lateral MovementT1550 · Use Alternate Authentication Material
Max Altgelt (Nextron Systems)Wed Apr 06windows
Detectionhightest

Potential Privilege Escalation via Local Kerberos Relay over LDAP

Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.

Windowssecurity
TA0005 · Defense EvasionTA0004 · Privilege EscalationTA0006 · Credential AccessT1548 · Abuse Elevation Control Mechanism
Elastic SecurityWed Apr 27windows
Detectionhightest

RottenPotato Like Attack Pattern

Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like

Windowssecurity
TA0009 · CollectionTA0004 · Privilege EscalationTA0006 · Credential AccessT1557.001 · LLMNR/NBT-NS Poisoning and SMB Relay
@sbousseaden+1Fri Nov 15windows
Detectionhightest

Windows Filtering Platform Blocked Connection From EDR Agent Binary

Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents. Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.

Windowssecurity
TA0005 · Defense EvasionT1562 · Impair Defenses
@gott_cyberMon Jan 08windows
Detectionmediumtest

Azure AD Health Monitoring Agent Registry Keys Access

This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent.

Windowssecurity
TA0007 · DiscoveryT1012 · Query Registry
Roberto Rodriguez (Cyb3rWard0g)+2Thu Aug 26windows
Detectionmediumtest

Azure AD Health Service Agents Registry Keys Access

This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation). This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent. Make sure you set the SACL to propagate to its sub-keys.

Windowssecurity
TA0007 · DiscoveryT1012 · Query Registry
Roberto Rodriguez (Cyb3rWard0g)+2Thu Aug 26windows
Detectionhightest

Powerview Add-DomainObjectAcl DCSync AD Extend Right

Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer

Windowssecurity
TA0004 · Privilege EscalationTA0003 · PersistenceT1098 · Account Manipulation
Samir Bousseaden+4Wed Apr 03windows
Detectionhightest

AD Privileged Users or Groups Reconnaissance

Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs

Windowssecurity
TA0007 · DiscoveryT1087.002 · Domain Account
Samir BousseadenWed Apr 03windows
Detectioncriticaltest

AD Object WriteDAC Access

Detects WRITE_DAC access to a domain object

Windowssecurity
TA0005 · Defense Evasionattack.t1222.001
Roberto Rodriguez (Cyb3rWard0g)Thu Sep 12windows
Detectioncriticaltest

Active Directory Replication from Non Machine Account

Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.

Windowssecurity
TA0006 · Credential AccessT1003.006 · DCSync
Roberto Rodriguez (Cyb3rWard0g)Fri Jul 26windows
Detectionmediumtest

Potential AD User Enumeration From Non-Machine Account

Detects read access to a domain user from a non-machine account

Windowssecurity
TA0007 · DiscoveryT1087.002 · Domain Account
Maxime ThiebautMon Mar 30windows
Detectionlowtest

ADCS Certificate Template Configuration Vulnerability

Detects certificate creation with template allowing risk permission subject

Windowssecurity
TA0004 · Privilege EscalationTA0006 · Credential Access
Orlinum+1Wed Nov 17windows
Detectionhightest

ADCS Certificate Template Configuration Vulnerability with Risky EKU

Detects certificate creation with template allowing risk permission subject and risky EKU

Windowssecurity
TA0004 · Privilege EscalationTA0006 · Credential Access
Orlinum+1Wed Nov 17windows
Detectionlowtest

Add or Remove Computer from DC

Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.

Windowssecurity
TA0005 · Defense Evasionattack.t1207
François HubautFri Oct 14windows
Detectionlowtest

Access To ADMIN$ Network Share

Detects access to ADMIN$ network share

Windowssecurity
TA0008 · Lateral MovementT1021.002 · SMB/Windows Admin Shares
Florian Roth (Nextron Systems)Sat Mar 04windows
Detectionhightest

Enabled User Right in AD to Control User Objects

Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.

Windowssecurity
TA0004 · Privilege EscalationTA0003 · PersistenceT1098 · Account Manipulation
@neu5ronSun Jul 30windows
Detectionhightest

Active Directory User Backdoors

Detects scenarios where one can control another users or computers account without having to use their credentials.

Windowssecurity
TA0004 · Privilege EscalationT1098 · Account ManipulationTA0003 · Persistence
@neu5ronThu Apr 13windows
Detectionhightest

Weak Encryption Enabled and Kerberoast

Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.

Windowssecurity
TA0005 · Defense EvasionT1562.001 · Disable or Modify Tools
@neu5ronSun Jul 30windows
Detectionhightest

Hacktool Ruler

This events that are generated when using the hacktool Ruler by Sensepost

Windowssecurity
TA0005 · Defense EvasionTA0007 · DiscoveryTA0002 · ExecutionTA0009 · Collection+5
Florian Roth (Nextron Systems)Wed May 31windows
Detectionmediumtest

Remote Task Creation via ATSVC Named Pipe

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Windowssecurity
TA0004 · Privilege EscalationTA0002 · ExecutionTA0008 · Lateral MovementTA0003 · Persistence+3
Samir BousseadenWed Apr 03windows
Detectionhightest

Security Eventlog Cleared

One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution

Windowssecurity
TA0005 · Defense EvasionT1070.001 · Clear Windows Event Logs2016-04-002 · CAR 2016-04-002
Florian Roth (Nextron Systems)Tue Jan 10windows
Detectionmediumtest

Processes Accessing the Microphone and Webcam

Potential adversaries accessing the microphone and webcam in an endpoint.

Windowssecurity
TA0009 · CollectionT1123 · Audio Capture
Roberto Rodriguez (Cyb3rWard0g)+1Sun Jun 07windows