SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,763 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects DNS queries to domains associated with legitimate remote access software (e.g., TeamViewer, Go2Assist, LogMeIn, AmmyyAdmin, RustDesk, Quick Assist, Remote Utilities, Tailscale, Twingate, NetSupport Manager) when those queries originate from a non-browser application. Adversaries often leverage these legitimate tools to establish command and control (C2) channels or maintain persistence on compromised systems, as they may be allowed by application control policies. The rule includes extensive filters to exclude common web browsers and other legitimate system processes that might legitimately query these domains, aiming to reduce false positives.
Detects potential execution of MeshAgent which is a tool used for remote access.
Historical data shows that threat actors rename MeshAgent binary to evade detection.
Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.
Historical data shows that threat actors rename MeshAgent binary to evade detection.
Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.
This rule detects attempts to hijack legitimate RDP sessions to establish persistence on the RDP source machine. Specifically, it looks for file creation events where the 'mstsc.exe' process (Microsoft Remote Desktop Connection client) is involved in writing a file to a user's 'Startup' folder. This technique can be used by an attacker to place a backdoor or malicious executable that will run automatically when the user logs into the RDP source machine.
Detects antivirus alerts indicating the presence of exploitation frameworks or known offensive security tools. This rule emphasizes the importance of investigating such alerts, even if the malware is blocked, to understand the initial compromise vector.
Detects a specific user agent string and host ('api.dropbox.com') associated with an APT40 Dropbox tool, indicating potential data exfiltration or command and control activity via Dropbox.
Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic. This pattern often involves a hexadecimal string followed by two subdomains and a top-level domain.
Detects potential Remote Desktop Protocol (RDP) connections initiated via 'mstsc.exe' using a local '.rdp' file. This behavior can be indicative of an adversary establishing remote access to a system.
This rule detects the successful installation of the Atera Remote Monitoring & Management (RMM) agent by looking for specific Event ID 1033 from the MsiInstaller provider, where the message content includes 'AteraAgent'. This activity has been associated with threat actors, specifically Conti operators, using the Atera agent for command and control.
Detects an initiated network connection over uncommon ports from "dfsvc.exe". dfsvc.exe is a utility used to handle ClickOnce applications. Adversaries may abuse ClickOnce to proxy execution of malicious code, and unexpected network connections from this process, especially on non-standard ports, could indicate malicious activity.
Detects a DNS query to 'azurewebsites.net' originating from a process that is not a recognized web browser. Threat actors have frequently used 'azurewebsites.net' for malware hosting and data exfiltration. This rule aims to identify suspicious communication patterns where non-browser applications might be attempting to communicate with known malicious infrastructure hosted on Azure.
Page 309 of 680