SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,676 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of suspicious files (jsp, java, class) in specific SAP NetWeaver directories. This activity may indicate an attempt to establish a webshell or exploit vulnerabilities, such as CVE-2025-31324, to gain persistent access or execute arbitrary code within the SAP environment.
Detects remote thread creation in command shell applications, such as "Cmd.EXE" and "PowerShell.EXE". This is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.
Detects when an AWS Route 53 domain is transferred to another AWS account. This activity could indicate an attempt by an adversary to maintain persistence or exfiltrate domain control by moving it to an account they control.
This rule identifies suspicious activity related to Security Assertion Markup Language (SAML) in AWS. Specifically, it looks for two events: `AssumeRoleWithSAML` from the `sts.amazonaws.com` service and `UpdateSAMLProvider` from the `iam.amazonaws.com` service. An adversary could leverage these actions to gain unauthorized access, establish persistence, or escalate privileges within an AWS environment by manipulating SAML providers or assuming roles via SAML.
Detects when certificate-based authentication has been enabled in an Azure Active Directory tenant. This change can be an indicator of an adversary establishing a new authentication method for persistence or privilege escalation, or preparing for such activities.
This rule detects the creation of new systemd service unit files in standard systemd directories. Adversaries often create or modify systemd services to establish persistence or escalate privileges by executing malicious code at system startup or when specific events occur. The rule specifically looks for file creation events in '/usr/lib/systemd/system/', '/etc/systemd/system/', and user-specific '/.config/systemd/user/' directories, which are common locations for systemd unit files.
Detects the execution of the 'doas' utility on Linux systems. 'doas' allows standard users to execute commands as another user, typically root, similar to 'sudo'. This can be used by adversaries for privilege escalation or defense evasion.
Detects attempts to add a user account to the 'admin' group on macOS using the `dseditgroup` utility, which grants administrative privileges to the added user. This action can be used for persistence, privilege escalation, or defense evasion by an attacker.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. This rule specifically looks for the `TeamViewer_Desktop` process being launched by `TeamViewer_Service` with specific command-line arguments, indicating a remote connection. An investigator can verify connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
This rule detects modifications to Cisco device configurations that could be used by an adversary for persistence, privilege escalation, or to impact system availability. Specifically, it looks for commands related to enabling HTTP/HTTPS servers, configuring Kron jobs (scheduled tasks), modifying access lists, archiving configurations, and setting NTP servers. These commands, if used maliciously, can allow an attacker to maintain access, execute arbitrary commands, control network access, or disrupt time synchronization.
Page 208 of 680