SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,763 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects update checks performed by Advanced IP Scanner and Advanced Port Scanner utilities. These utilities are often used for network reconnaissance and can be considered Potentially Unwanted Applications (PUA) in some environments. The rule specifically looks for requests to '/checkupdate.php' with a set of specific query parameters, indicating an update check from these tools.
Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP. This activity can indicate an attacker exploiting a public-facing application to gain initial access and execute arbitrary commands.
Detects remote RPC calls made by SharpHound, a BloodHound data collector, to enumerate remote connections and local group memberships. This specific rule targets the MS-SRVS protocol (Server Service Remote Protocol) interface UUID 4b324fc8-1670-01d3-1278-5a47bf6ee188 and operation number 12, which is associated with session enumeration.
This rule detects remote RPC calls to the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) originating from hosts that are not designated as Domain Controllers. Such activity is highly indicative of potential DCSync or DCShadow attacks, where an attacker attempts to replicate Active Directory data, including sensitive credentials, by impersonating a Domain Controller. The rule specifically looks for RPC Firewall logs (EventLog: RPCFW, EventID: 3) where the InterfaceUuid matches 'e3514235-4b06-11d1-ab04-00c04fc2dcd2' (MS-DRSR) and the operation number (OpNum) is not 0, 1, or 12, as these are considered 'dangerous' opcodes when initiated from non-DC hosts.
Detects attempts to execute remote commands within a Kubernetes Pod's container, typically using the 'kubectl exec' command. This activity is logged as a 'create' verb on the 'pods' resource with the 'exec' subresource in Kubernetes audit logs.
Detects the use of the `syslog` syscall with action codes 4, 5, or 6, which can clear or disable the kernel ring buffer (dmesg logs). This technique can be used by attackers to hide traces after exploitation or privilege escalation. A common method is running `dmesg -c`, which internally triggers this syscall.
Detects attempts by an identity to enumerate its Kubernetes Role-Based Access Control (RBAC) permissions. This activity is often observed in the early stages of a breach as attackers try to understand their access within a compromised Kubernetes environment. This can be achieved by querying the Kubernetes API server's SelfSubjectRulesReview API, for example, using the "kubectl auth can-i --list" command.
Detects attempts to enumerate Kubernetes secrets, which could indicate an adversary is searching for sensitive information like API keys, tokens, or other credentials stored within the cluster.
This rule detects when an Azure Container Registry is either created or deleted. Monitoring these operations can help identify unauthorized infrastructure changes, potential resource manipulation, or attempts to cover tracks by removing evidence. An adversary might create a new container registry to host malicious images or delete an existing one to disrupt services or remove forensic artifacts.
This rule detects suspicious Kerberos Ticket Granting Ticket (TGT) requests, specifically looking for events where a computer account (indicated by a '$' at the end of the `TargetUserName`) requests a TGT with a certificate thumbprint present. This behavior is often observed after an attacker has obtained a computer certificate, potentially through techniques like PetitPotam, and is attempting to leverage it to request Kerberos tickets using tools like Rubeus. The rule focuses on Windows Event ID 4768, which signifies a Kerberos authentication service ticket request. It filters out requests from the local host (::1) and those without a certificate thumbprint.
Page 315 of 680