SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,757 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly.
MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.
MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.
Detects the creation of files with double extensions, a common technique used by malware to masquerade as benign files, especially when Windows is configured to hide known file extensions. This rule specifically looks for files ending with common executable or archive extensions (like .exe, .iso, .rar, .zip, .svg) preceded by another common file extension (like .doc, .pdf, .jpg, .png, etc.).
Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
This rule detects suspicious network connections to Dropbox API endpoints (api.dropboxapi.com or content.dropboxapi.com) originating from any executable that is not the legitimate Dropbox application. This behavior can indicate an adversary using a non-standard or malicious process to exfiltrate data or establish command and control via Dropbox.
Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.
Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse this feature to establish a reverse shell, persistence, or exfiltrate data from a compromised machine.
Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse this feature to establish a reverse shell or persistence on a machine.
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
Page 296 of 680