SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,531 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects disabling, deleting and updating of a Trail
Identifies when a firewall is created, modified, or deleted.
Detect when users are authenticating without MFA being required.
All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392'
The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.
The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.
Detects suspicious process command line that uses base64 encoded input for execution with a shell
Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Detects attempts to masquerade as legitimate files by adding a space to the end of the filename.
Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).
Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location.
Page 30 of 680