SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,763 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects attempts to hijack the Amazon SSM Agent on Linux systems. Specifically, it looks for the 'amazon-ssm-agent' executable being run with command-line arguments indicative of registration with a new code, ID, and region. This behavior is consistent with the technique described in the Mitiga research report where the SSM agent can be abused as a remote access trojan for persistence and command and control.
Detects the presence and execution of the Inveigh hack tool by monitoring for the creation of its characteristic log and executable files. Inveigh is a PowerShell-based tool used for network sniffing, LLMNR/NBNS/mDNS spoofing, and NTLM relay attacks.
Detects the execution of the Microsoft Quick Assist tool, 'QuickAssist.exe'. This utility can be leveraged by attackers to gain remote access to a system, often in social engineering attacks leading to further compromise like ransomware.
Detects potential Java webshell uploads to an SAP NetViewer server via HTTP POST requests with a 'Content-Type' of 'application/octet-stream' and URI stems containing '/irj/' and ending with '.jsp', '.class', or '.java'. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells.
This rule detects the installation of the TacticalRMM agent service on a Windows system. It specifically looks for Event ID 7045 from the 'Service Control Manager' provider, indicating a service installation, and then checks if the 'ImagePath' contains 'tacticalrmm.exe' or the 'ServiceName' contains 'TacticalRMM Agent Service'. TacticalRMM is a legitimate remote monitoring and management (RMM) tool, but it can be abused by adversaries for remote access and control.
Detects DNS queries to legitimate TeamViewer domains originating from an application that is not identified as TeamViewer. This behavior can indicate an adversary attempting to obfuscate their use of remote access software by renaming the executable or using a different process to initiate the connection.
Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research, it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll, which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API.
This rule detects the creation of temporary installation artifacts for GoToAssist Remote Support Expert in the user's AppData\Local\Temp directory. Adversaries often use legitimate remote access tools like GoToAssist to establish command and control, and the presence of these temporary files can indicate such activity.
Detects the creation of temporary files (sam.tmp, sec.tmp, sys.tmp) in the Windows temporary directory, which are indicators of the RemoteKrbRelay SMB Relay attack module attempting to dump secrets from the Security Account Manager (SAM) and other system hives.
This rule detects the creation of 'TeamViewer_Desktop.exe' on a Windows system. This file is typically created during the installation of TeamViewer, a legitimate remote access tool. Adversaries often abuse such tools for command and control, making its installation a potential indicator of compromise.
Page 311 of 680