SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,764 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation or modification of files containing the string '\Bin\ScreenConnect.' in their target filename. This pattern is indicative of temporary installation artifacts for ScreenConnect, a legitimate remote access tool that can be abused by adversaries for command and control or remote access. The rule aims to identify the presence of these artifacts, which could signal the installation or use of ScreenConnect on a system.
This rule detects the execution of 'tscon.exe' with SYSTEM privileges. 'tscon.exe' is a legitimate Windows utility used to connect to or disconnect from a session on a Remote Desktop Session Host server. When executed as SYSTEM, it can be used by an attacker to hijack an active RDP session without requiring credentials or user interaction, leading to privilege escalation and lateral movement. This technique is often referred to as RDP session hijacking.
Detects the download of Ursnif malware based on specific URL patterns and a successful HTTP status code. The rule looks for URIs containing a forward slash, '.php?l=', and ending with '.cab', combined with an HTTP status code of 200, indicating a successful download.
This rule detects the creation of processes associated with UltraVNC Viewer, a legitimate remote access software. Adversaries often use such tools to establish command and control (C2) channels to target systems, enabling remote interaction and control. The rule specifically looks for process creation events where the description is 'VNCViewer', the product is 'UltraVNC VNCViewer', the company is 'UltraVNC', or the original filename is 'VNCViewer.exe'.
Detects Ursnif C2 traffic by identifying specific URL patterns in proxy logs. The rule looks for URIs containing base64-like encoding indicators ('_2f', '_2b') in combination with specific file extensions and directory names ('.avi' and '/images/'). This combination is indicative of Ursnif malware's command and control communication.
Detects network communication patterns associated with the Turla ComRAT malware, specifically looking for HTTP/HTTPS requests containing '/index/index.php?h=' in the URI. This pattern is indicative of ComRAT's command and control (C2) communication.
Detects suspicious process access to the Local Security Authority Subsystem Service (LSASS) memory. The rule specifically looks for processes attempting to access LSASS with certain access flags from potentially suspicious folders like temporary directories or user application data folders. This behavior is indicative of credential dumping attempts, often performed by malware or attackers to harvest credentials.
Detects potential command execution via webshell in SAP NetViewer through JSP files with 'cmd' or similar parameters. This rule is designed to identify exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell by looking for specific URI patterns and query parameters indicative of command execution attempts, including common Linux commands and base64 encoded commands.
This rule detects DNS queries made to domains frequently used by threat actors for hosting malware payloads or for URL redirection via shortener services. The identified domains include those associated with platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc. Such DNS activity can be an indicator of potential malware delivery attempts or command-and-control (C2) communications.
Detects the silent installation of AnyDesk Remote Desktop, which can be used by attackers to gain remote access to a system. The rule specifically looks for the command-line arguments '--install', '--start-with-win', and '--silent' used together during process creation.
Page 312 of 680