SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,731 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation or modification of specific files identified as indicators of compromise (IOCs) used by UNC4841 in their exploitation of Barracuda ESG appliances. These files are associated with various stages of the attack, including persistence, execution, and defense evasion.
This rule detects DNS resolution attempts for domains associated with Tor onion services and Tor2web gateways. It specifically looks for DNS queries ending with various Tor-related top-level domains and subdomains, indicating potential use of the Tor network for anonymization or accessing hidden services.
Detects the execution of JavaScript or JSC files using the Node.js binary (node.exe). This activity can be suspicious as adversaries have been observed abusing Node.js to disguise malware, evade security defenses, and maintain persistence. While Node.js is commonly used, unusual occurrences of this activity in an environment warrant immediate investigation.
Detects potentially suspicious inline JavaScript execution using the Node.js binary. The rule specifically looks for the execution of 'node.exe' combined with command-line arguments that contain keywords indicative of malicious activity, such as 'http' (for network communication), 'execSync' or 'spawn' (for executing system commands), 'fs' (for file system operations), 'path', and 'zlib' (often used in unpacking or data manipulation). This combination suggests an attempt to execute arbitrary code or perform system interactions via Node.js.
Detects the execution of the 'FileGrabber' component of the Amos infostealer on macOS. This rule specifically looks for command-line arguments containing both 'FileGrabber' and '/tmp', indicating the execution of this malicious component, which is known to target sensitive user files.
Detects DNS queries to an ".onion" address or other domains associated with Tor routing networks and Tor2web proxies. This indicates potential use of Tor for anonymous communication or access to dark web services.
Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components. This rule specifically looks for `conhost.exe` spawning `cmd.exe`, `cscript.exe`, `mshta.exe`, `powershell_ise.exe`, `powershell.exe`, `pwsh.exe`, `regsvr32.exe`, or `wscript.exe`.
Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string and performs GET requests. This activity is indicative of reconnaissance or data scraping.
This rule detects suspicious filenames that leverage the right-to-left override (RTLO) Unicode character (U+202E) in conjunction with a spoofed file extension. Adversaries use RTLO to visually reverse parts of a filename, making a malicious executable appear as a benign file type (e.g., 'evil.exe' appearing as 'evil.txt.exe' or 'document.pdf' appearing as 'document.exe'). The rule specifically looks for the RTLO character and a list of common file extensions that have been reversed (e.g., '3pm.' for '.mp3', 'cod.' for '.doc'). This technique is often used in phishing attacks to trick users into executing malicious files.
This rule detects the execution of `mmc.exe` with command-line arguments that indicate the use of Right-to-Left Override (RTLO) characters to disguise file extensions. Specifically, it looks for `.msc` files that, due to RTLO abuse, appear to be common document types like `.pdf`, `.doc`, `.xlsx`, etc., but are actually `.msc` files. This technique is often used by adversaries for defense evasion and to trick users into executing malicious files.
Page 277 of 680