SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,761 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of SimpleHelp remote access software. SimpleHelp is a legitimate desktop support and remote access tool that adversaries may abuse to establish command and control (C2) channels. The rule specifically looks for process creation events where the image path contains "JWrapper-Remote Access" or "JWrapper-Remote Support" and the executable name is "SimpleService.exe". This pattern indicates the execution of the SimpleHelp service component.
Detects potential execution of MeshAgent, a remote access tool, on macOS systems. The rule specifically looks for the '--meshServiceName' argument in the command line, which is indicative of MeshAgent usage. Threat actors often rename the MeshAgent binary to evade detection, making command-line arguments a more reliable indicator.
Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. This rule specifically looks for process creation events on macOS where the command line contains '--meshServiceName' or the original filename contains 'meshagent', but the image path does not end with the legitimate '/meshagent' or '/meshagent_osx64' paths. This behavior is indicative of an adversary attempting to bypass detection by masquerading the RMM tool.
This rule detects the creation of hidden files or directories on Linux systems. It specifically looks for common commands like 'mkdir', 'nano', 'touch', 'vi', or 'vim' being executed with arguments that start with a '.' (dot), which is the standard convention for hidden files and directories in Unix-like operating systems. This behavior is often used by adversaries for defense evasion.
Detects potential Active Directory enumeration via LDAP
Detects suspicious Kerberos TGT requests with pre-authentication disabled (Pre-Authentication Type = 0) and Ticket Encryption Type (0x17) i.e, RC4-HMAC.
This may indicate an AS-REP Roasting attack, where attackers request AS-REP messages for accounts without pre-authentication and attempt to crack the encrypted ticket offline to recover user passwords.
This may indicate an AS-REP Roasting attack, where attackers request AS-REP messages for accounts without pre-authentication and attempt to crack the encrypted ticket offline to recover user passwords.
Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. Malicious actors often rename legitimate tools like MeshAgent to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely. This could be an indication of malicious software deployment or lateral movement attempts using Windows Installer functionality. The usage of the WindowsInstaller COM object rather than msiexec could be an attempt to bypass detection.
Detects potential execution of MeshAgent, a remote access tool, by looking for the '--meshServiceName' argument in the command line. Threat actors often rename the MeshAgent binary to evade detection, making this command-line argument a more reliable indicator of its use for remote access.
Detects the use of the "capsh" utility to invoke a shell.
Page 306 of 680