SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,761 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation or modification of AnyDesk configuration files (user.conf and system.conf) in the AppData\Roaming\AnyDesk directory. Adversaries often use legitimate remote access tools like AnyDesk to establish command and control, and the presence of these configuration files can indicate its use on a system. This rule helps identify the presence of AnyDesk artifacts, which could be indicative of legitimate use or malicious activity.
Detects the creation of specific log files associated with TeamViewer remote sessions. This can indicate the use of TeamViewer for remote access, which might be legitimate or malicious depending on the context.
Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE", "DROP DATABASE", or "TRUNCATE TABLE". These operations can lead to data loss and impact system availability.
Detects HTTP requests containing the URI pattern '/asp.asp?ui=' which is known to be used by the Chafer malware for command and control communication to receive data from its C2 server.
Detects potential CSharp Streamer RAT loading a .NET executable image by identifying a specific file name pattern and path commonly associated with the tool. This rule looks for image loads from a temporary directory with a filename matching 'dat[0-9A-Z]{4}\.tmp'.
Detects the execution of Action1, a Remote Monitoring and Management (RMM) tool, for arbitrary code execution or to establish remote sessions. The rule identifies these activities by looking for specific command-line patterns associated with Action1 agent deployments, script execution (via cmd.exe or powershell.exe), and the initiation of remote sessions through 'agent1_remote.exe'. The description also provides hunting opportunities to refine detection by baselining policy names and identifying remote sessions during abnormal hours.
Detects logons using NTLM to hosts that are potentially not part of the domain, specifically targeting Remote Desktop Protocol (RDP) connections. This could indicate an attempt to establish remote access to systems outside of the managed domain, potentially for lateral movement or persistence.
Detects incoming network connections to the AnyDesk remote access application. This activity could indicate an adversary attempting to establish a remote command and control channel or gain unauthorized access to a system using a legitimate remote access tool.
This rule detects attempts to hijack the Amazon SSM Agent on Linux systems. Specifically, it looks for the 'amazon-ssm-agent' executable being run with command-line arguments indicative of registration with a new code, ID, and region. This behavior is consistent with the technique described in the Mitiga research report where the SSM agent can be abused as a remote access trojan for persistence and command and control.
Detects the presence and execution of the Inveigh hack tool by monitoring for the creation of its characteristic log and executable files. Inveigh is a PowerShell-based tool used for network sniffing, LLMNR/NBNS/mDNS spoofing, and NTLM relay attacks.
Page 310 of 680