SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,528 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the modification of VPN SSL Settings (for example, the modification of authentication rules).
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
Detects the attempt to install new skills for AI agents using the "npx skills" command.
Agent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user.
The "npx skills" command can install skills for various agents (e.g., Claude Code, Cursor, and others).
Analysts should review any installed skills to verify their legitimacy.
Note: Tune this rule based on whether AI agent tooling is allowed in your environment.
In environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly.
In environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation.
Agent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user.
The "npx skills" command can install skills for various agents (e.g., Claude Code, Cursor, and others).
Analysts should review any installed skills to verify their legitimacy.
Note: Tune this rule based on whether AI agent tooling is allowed in your environment.
In environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly.
In environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation.
Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution
Detects the creation of a new local user on a Fortinet FortiGate Firewall.
The new local user could be used for VPN connections.
The new local user could be used for VPN connections.
Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall.
This behavior was observed in pair with modification of VPN SSL settings.
This behavior was observed in pair with modification of VPN SSL settings.
Detects a highly relevant Antivirus alert that reports APT malware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports an exploitation framework.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports ransomware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder.
This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.
This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.
Page 17 of 680