SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,723 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm, and others in order to load malicious payloads in context of legitimate Java processes. The rule filters out legitimate loads from common installation paths and specific applications like Eclipse.
Detects execution of python using the "-c" flag. This could be used as a way to launch a reverse shell or execute live python code. The rule filters out common legitimate uses of `python -c` by Python itself, pip, and VS Code.
Detects remote RPC calls to create or execute a scheduled task via ATSvc
Detects remote RPC calls to create or execute a scheduled task
Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.
Number of VM creations or deployment activities occur in Azure via the azureactivity log.
Detects when a user is removed from a privileged role. Bulk changes should be investigated.
Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.
Detect attempt to enable auditing of TTY input
Detects the use of at/atd which are utilities that are used to schedule tasks.
They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code
They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code
Page 262 of 680