SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,720 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when a Microsoft Office application (Word, Excel, PowerPoint, Outlook, WordView) initiates an outbound network connection to an IP address that is not a private IP range or a known Microsoft/Akamai IP range. This rule aims to identify suspicious network activity from Office applications, potentially indicative of malware or exploitation, similar to behavior seen in CVE-2021-42292. Initial baselining and tuning are required to adapt to specific organizational environments.
Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.
Detects access to known sensitive file extensions on network shares. This can indicate an adversary attempting to collect sensitive data such as backups, memory dumps, Kerberos tickets, or various email/messaging data files.
Detects the execution of suspicious commands often used in Command and Control (C2) activities, as identified in Florian Roth's 'Best Practice Auditd Configuration'. These commands include `wget`, `curl`, `base64`, `nc`, `netcat`, `ncat`, `ssh`, `socat`, `wireshark`, `rawshark`, `rdesktop`, and `nmap`. These tools can be leveraged for various adversarial techniques such as data transfer, remote access, network discovery, and data encoding.
Detects PowerShell processes executing commands that utilize `Net.WebClient` to download content, indicated by the presence of `new-object`, `net.webclient).`, and `download` keywords in the command line, along with either `string(` or `file(`. This pattern is commonly used by adversaries for ingress tool transfer or to fetch additional malicious payloads.
This rule detects the use of various command-line tools and PowerShell cmdlets that can initiate web requests. These include native Windows PowerShell cmdlets like 'Invoke-RestMethod', 'Invoke-WebRequest', 'Resume-BitsTransfer', 'Start-BitsTransfer', and their aliases ('irm', 'iwr'), as well as common command-line utilities like 'curl' and 'wget', and .NET framework calls such as '[System.Net.WebRequest]::create' and 'WinHttp.WinHttpRequest'. Adversaries often use these methods to download additional tools, malware, or exfiltrate data from a compromised system.
Detects the removal or modification of system firewall rules using common Linux firewall management tools like iptables, firewall-cmd, ufw, and nft. This rule specifically looks for commands that delete or remove existing rules, which adversaries might use to bypass network controls and enable C2 communications, lateral movement, or data exfiltration. This detection aims to catch more granular firewall modifications than just a complete firewall disablement.
Detects (failed) outbound connection attempts to internet-facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397, which is a critical elevation of privilege vulnerability in Microsoft Outlook. The vulnerability allows an attacker to send a specially crafted email that, when opened, causes the victim's system to connect to an attacker-controlled SMB share and leak the victim's NTLM hash. This rule specifically looks for SMB client connectivity events (Event IDs 30803, 30804, 30806) where the destination IP address is not a private or loopback address, indicating an attempt to connect to an external SMB server.
This rule detects the use of various web request commands and cmdlets within PowerShell script block logs. It specifically looks for common methods used to initiate web requests or file transfers, such as `[System.Net.WebRequest]::create`, `curl`, `Invoke-RestMethod`, `Invoke-WebRequest`, `irm`, `iwr`, `Resume-BitsTransfer`, `Start-BitsTransfer`, `wget`, and `WinHttp.WinHttpRequest`. The rule aims to identify suspicious activity where PowerShell is used to download or interact with remote resources, potentially for ingress tool transfer or command and control. A filter is applied to exclude paths starting with 'C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\', which are likely legitimate system activities.
Detects the use of Windows 8.3 short filenames (e.g., `PROGRA~1`) in process image paths. This technique can be used by adversaries to evade detection mechanisms that rely on full file paths, as the short name might bypass certain allow-listing or block-listing rules.
Page 253 of 680