Rule Library

Sigma Rules

2,824 rules found

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionhightest

RDP Login from Localhost

RDP login with localhost source address may be a tunnelled login

Windowssecurity
TA0008 · Lateral Movement2013-07-002 · CAR 2013-07-002T1021.001 · Remote Desktop Protocol
Thomas PatzkeMon Jan 28windows
Detectionlowstable

A Security-Enabled Global Group Was Deleted

Detects activity when a security-enabled global group is deleted

Windowssecurity
TA0004 · Privilege EscalationTA0003 · PersistenceT1098 · Account Manipulation
Alexandr Yampolskyi+1Wed Apr 26windows
Detectionmediumtest

External Remote RDP Logon from Public IP

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Windowssecurity
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionTA0001 · Initial Access+4
Micah Babinski+1Thu Jan 19windows
Detectionhightest

External Remote SMB Logon from Public IP

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Windowssecurity
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionTA0001 · Initial Access+4
Micah Babinski+1Thu Jan 19windows
Detectionmediumtest

Failed Logon From Public IP

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

Windowssecurity
TA0004 · Privilege EscalationTA0005 · Defense EvasionTA0001 · Initial AccessTA0003 · Persistence+3
NVISOWed May 06windows
Detectionlowtest

Outgoing Logon with New Credentials

Detects logon events that specify new credentials

Windowssecurity
TA0005 · Defense EvasionTA0008 · Lateral MovementT1550 · Use Alternate Authentication Material
Max Altgelt (Nextron Systems)Wed Apr 06windows
Detectionhightest

Potential Privilege Escalation via Local Kerberos Relay over LDAP

Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.

Windowssecurity
TA0005 · Defense EvasionTA0004 · Privilege EscalationTA0006 · Credential AccessT1548 · Abuse Elevation Control Mechanism
Elastic SecurityWed Apr 27windows
Detectionhightest

RottenPotato Like Attack Pattern

Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like

Windowssecurity
TA0009 · CollectionTA0004 · Privilege EscalationTA0006 · Credential AccessT1557.001 · LLMNR/NBT-NS Poisoning and SMB Relay
@sbousseaden+1Fri Nov 15windows
Detectionlowstable

Successful Account Login Via WMI

Detects successful logon attempts performed with WMI

Windowssecurity
TA0002 · ExecutionT1047 · Windows Management Instrumentation
Thomas PatzkeWed Dec 04windows
Detectionhightest

Windows Filtering Platform Blocked Connection From EDR Agent Binary

Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents. Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.

Windowssecurity
TA0005 · Defense EvasionT1562 · Impair Defenses
@gott_cyberMon Jan 08windows
Detectionmediumtest

Azure AD Health Monitoring Agent Registry Keys Access

This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent.

Windowssecurity
TA0007 · DiscoveryT1012 · Query Registry
Roberto Rodriguez (Cyb3rWard0g)+2Thu Aug 26windows
Detectionmediumtest

Azure AD Health Service Agents Registry Keys Access

This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation). This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent. Make sure you set the SACL to propagate to its sub-keys.

Windowssecurity
TA0007 · DiscoveryT1012 · Query Registry
Roberto Rodriguez (Cyb3rWard0g)+2Thu Aug 26windows
Detectionhightest

Powerview Add-DomainObjectAcl DCSync AD Extend Right

Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer

Windowssecurity
TA0004 · Privilege EscalationTA0003 · PersistenceT1098 · Account Manipulation
Samir Bousseaden+4Wed Apr 03windows
Detectionhightest

AD Privileged Users or Groups Reconnaissance

Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs

Windowssecurity
TA0007 · DiscoveryT1087.002 · Domain Account
Samir BousseadenWed Apr 03windows
Detectionlowtest

ADCS Certificate Template Configuration Vulnerability

Detects certificate creation with template allowing risk permission subject

Windowssecurity
TA0004 · Privilege EscalationTA0006 · Credential Access
Orlinum+1Wed Nov 17windows
Detectionhightest

ADCS Certificate Template Configuration Vulnerability with Risky EKU

Detects certificate creation with template allowing risk permission subject and risky EKU

Windowssecurity
TA0004 · Privilege EscalationTA0006 · Credential Access
Orlinum+1Wed Nov 17windows
Detectionlowtest

Add or Remove Computer from DC

Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.

Windowssecurity
TA0005 · Defense Evasionattack.t1207
François HubautFri Oct 14windows
Detectionlowtest

Access To ADMIN$ Network Share

Detects access to ADMIN$ network share

Windowssecurity
TA0008 · Lateral MovementT1021.002 · SMB/Windows Admin Shares
Florian Roth (Nextron Systems)Sat Mar 04windows
Detectioncriticaltest

AD Object WriteDAC Access

Detects WRITE_DAC access to a domain object

Windowssecurity
TA0005 · Defense Evasionattack.t1222.001
Roberto Rodriguez (Cyb3rWard0g)Thu Sep 12windows
Detectioncriticaltest

Active Directory Replication from Non Machine Account

Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.

Windowssecurity
TA0006 · Credential AccessT1003.006 · DCSync
Roberto Rodriguez (Cyb3rWard0g)Fri Jul 26windows
Detectionmediumtest

Potential AD User Enumeration From Non-Machine Account

Detects read access to a domain user from a non-machine account

Windowssecurity
TA0007 · DiscoveryT1087.002 · Domain Account
Maxime ThiebautMon Mar 30windows
Detectionhightest

Enabled User Right in AD to Control User Objects

Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.

Windowssecurity
TA0004 · Privilege EscalationTA0003 · PersistenceT1098 · Account Manipulation
@neu5ronSun Jul 30windows
Detectionhightest

Active Directory User Backdoors

Detects scenarios where one can control another users or computers account without having to use their credentials.

Windowssecurity
TA0004 · Privilege EscalationT1098 · Account ManipulationTA0003 · Persistence
@neu5ronThu Apr 13windows
Detectionhightest

Weak Encryption Enabled and Kerberoast

Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.

Windowssecurity
TA0005 · Defense EvasionT1562.001 · Disable or Modify Tools
@neu5ronSun Jul 30windows
Detectionhightest

Hacktool Ruler

This events that are generated when using the hacktool Ruler by Sensepost

Windowssecurity
TA0005 · Defense EvasionTA0007 · DiscoveryTA0002 · ExecutionTA0009 · Collection+5
Florian Roth (Nextron Systems)Wed May 31windows
Detectionmediumtest

Remote Task Creation via ATSVC Named Pipe

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Windowssecurity
TA0004 · Privilege EscalationTA0002 · ExecutionTA0008 · Lateral MovementTA0003 · Persistence+3
Samir BousseadenWed Apr 03windows
Detectionhightest

Security Eventlog Cleared

One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution

Windowssecurity
TA0005 · Defense EvasionT1070.001 · Clear Windows Event Logs2016-04-002 · CAR 2016-04-002
Florian Roth (Nextron Systems)Tue Jan 10windows
Detectionmediumtest

Processes Accessing the Microphone and Webcam

Potential adversaries accessing the microphone and webcam in an endpoint.

Windowssecurity
TA0009 · CollectionT1123 · Audio Capture
Roberto Rodriguez (Cyb3rWard0g)+1Sun Jun 07windows
Detectionhightest

CobaltStrike Service Installations - Security

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Windowssecurity
TA0003 · PersistenceTA0002 · ExecutionTA0004 · Privilege EscalationTA0008 · Lateral Movement+3
Florian Roth (Nextron Systems)+1Wed May 26windows
Detectioninformationalstable

Failed Code Integrity Checks

Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.

Windowssecurity
TA0005 · Defense EvasionT1027.001 · Binary Padding
Thomas PatzkeTue Dec 03windows
Detectionmediumtest

DCERPC SMB Spoolss Named Pipe

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

Windowssecurity
TA0008 · Lateral MovementT1021.002 · SMB/Windows Admin Shares
OTR (Open Threat Research)Wed Nov 28windows
Detectionhightest

DCOM InternetExplorer.Application Iertutil DLL Hijack - Security

Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.

Windowssecurity
TA0008 · Lateral MovementT1021.002 · SMB/Windows Admin SharesT1021.003 · Distributed Component Object Model
Roberto Rodriguez (Cyb3rWard0g)+1Mon Oct 12windows
Detectionhightest

Mimikatz DC Sync

Detects Mimikatz DC sync security events

Windowssecurity
TA0006 · Credential AccessS0002 · MimikatzT1003.006 · DCSync
Benjamin Delpy+3Sun Jun 03windows
Detectionmediumexperimental

Windows Default Domain GPO Modification

Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modify these default GPOs to deploy malicious configurations across the domain.

Windowssecurity
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1484.001 · Group Policy Modification
Swachchhanda Shrawan Poudel (Nextron Systems)Sat Nov 22windows
Detectionmediumtest

Device Installation Blocked

Detects an installation of a device that is forbidden by the system policy

Windowssecurity
TA0001 · Initial AccessT1200 · Hardware Additions
François HubautFri Oct 14windows
Detectionlowtest

Windows Event Auditing Disabled

Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed. Also, it is recommended to turn off "Local Group Policy Object Processing" via GPO, which will make sure that Active Directory GPOs take precedence over local/edited computer policies via something such as "gpedit.msc". Please note, that disabling "Local Group Policy Object Processing" may cause an issue in scenarios of one off specific GPO modifications - however, it is recommended to perform these modifications in Active Directory anyways.

Windowssecurity
TA0005 · Defense EvasionT1562.002 · Disable Windows Event Logging
@neu5ron+1Sun Nov 19windows
Detectionhightest

Important Windows Event Auditing Disabled

Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.

Windowssecurity
TA0005 · Defense EvasionT1562.002 · Disable Windows Event Logging
Nasreddine Bencherchali (Nextron Systems)Tue Jun 20windows
Detectionhightest

ETW Logging Disabled In .NET Processes - Registry

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Windowssecurity
TA0003 · PersistenceTA0005 · Defense EvasionT1112 · Modify RegistryT1562 · Impair Defenses
Roberto Rodriguez (Cyb3rWard0g)+1Fri Jun 05windows
Detectionhightest

DPAPI Domain Backup Key Extraction

Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers

Windowssecurity
TA0006 · Credential AccessT1003.004 · LSA Secrets
Roberto Rodriguez (Cyb3rWard0g)Thu Jun 20windows
Detectionmediumtest

DPAPI Domain Master Key Backup Attempt

Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.

Windowssecurity
TA0006 · Credential AccessT1003.004 · LSA Secrets
Roberto Rodriguez (Cyb3rWard0g)Sat Aug 10windows
Detectionlowtest

External Disk Drive Or USB Storage Device Was Recognized By The System

Detects external disk drives or plugged-in USB devices.

Windowssecurity
T1091 · Replication Through Removable MediaT1200 · Hardware AdditionsTA0008 · Lateral MovementTA0001 · Initial Access
Keith WrightWed Nov 20windows
Detectionhightest

Persistence and Execution at Scale via GPO Scheduled Task

Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

Windowssecurity
TA0004 · Privilege EscalationTA0002 · ExecutionTA0003 · PersistenceTA0008 · Lateral Movement+1
Samir BousseadenWed Apr 03windows
Detectionhightest

Hidden Local User Creation

Detects the creation of a local hidden user account which should not happen for event ID 4720.

Windowssecurity
TA0003 · PersistenceT1136.001 · Local Account
Christian Burkard (Nextron Systems)Mon May 03windows
Detectionhightest

HackTool - EDRSilencer Execution - Filter Added

Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.

Windowssecurity
TA0005 · Defense EvasionT1562 · Impair Defenses
Thodoris PolyzosMon Jan 29windows
Detectionhightest

HackTool - NoFilter Execution

Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators

Windowssecurity
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1134 · Access Token ManipulationT1134.001 · Token Impersonation/Theft
Stamatis Chatzimangou (st0pp3r)Fri Jan 05windows
Detectionhightest

HybridConnectionManager Service Installation

Rule to detect the Hybrid Connection Manager service installation.

Windowssecurity
TA0003 · PersistenceT1554 · Compromise Host Software Binary
Roberto Rodriguez (Cyb3rWard0g)+1Mon Apr 12windows
Detectionhightest

Impacket PsExec Execution

Detects execution of Impacket's psexec.py.

Windowssecurity
TA0008 · Lateral MovementT1021.002 · SMB/Windows Admin Shares
Bhabesh RajMon Dec 14windows
Detectionhightest

Possible Impacket SecretDump Remote Activity

Detect AD credential dumping using impacket secretdump HKTL

Windowssecurity
TA0006 · Credential AccessT1003.002 · Security Account ManagerT1003.004 · LSA SecretsT1003.003 · NTDS
Samir Bousseaden+1Wed Apr 03windows