SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,732 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).
Detects known sensitive file extensions via Zeek
Detects known sensitive file extensions accessed on a network share
Detects the creation of files with an executable or script extension by an Office application.
Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses.
This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
This rule will require an initial baseline and tuning that is specific to your organization.
This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
This rule will require an initial baseline and tuning that is specific to your organization.
This rule detects when a non-Python process loads the "Python Core" image. This behavior is often indicative of an executable that has been bundled from Python code using tools like Py2Exe, PyInstaller, or cx_Freeze. Threat actors commonly use these tools to package malicious Python scripts into standalone executables, which can help obfuscate their code or bypass security measures. The rule filters out legitimate Python processes and common installation paths to reduce false positives.
This rule identifies DNS lookups associated with common Tor proxies and services. It detects queries for domains ending in '.onion' and various Tor gateway domains (e.g., '.hiddenservice.net', '.tor2web.com', '.tor-gateways.de'). This activity can indicate the use of the Tor network for anonymization, which adversaries may leverage for command and control, data exfiltration, or to obscure their malicious activities.
This rule detects instances where 'conhost.exe' spawns an uncommon child process. Typically, 'conhost.exe' should only spawn itself or specific system processes. The detection of other child processes could indicate malicious activity, such as the use of 'conhost.exe' as a Living Off The Land Binary (LOLBIN) for indirect command execution or as a vector for process injection. The rule specifically filters out legitimate 'conhost.exe' child processes and cases where the child process image is null or empty, focusing on unexpected executables.
Page 276 of 680