SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,639 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam.
The usage of this RPC function should be rare if ever used at all.
Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.
View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'
The usage of this RPC function should be rare if ever used at all.
Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.
View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'
Detects the presence of default Cobalt Strike certificate in the HTTPS traffic
Identifies clients that may be performing DNS lookups associated with common currency mining pools.
DNS TOR Proxies
Sigma
Identifies IPs performing DNS lookups associated with common Tor proxies.
Detects download of certain file types from hosts in suspicious TLDs
Detects executable downloads from suspicious remote systems
Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs
Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string
Detects source code enumeration that use GET requests by keyword searches in URL strings
Detects the Installation of a Exchange Transport Agent
Page 172 of 680