SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,767 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects potential DLL sideloading by identifying the loading of specific system DLLs from non-standard, non-system locations. Adversaries often use DLL sideloading to execute malicious code by placing a malicious DLL in a directory where a legitimate application will load it instead of the intended system DLL. The rule includes a comprehensive list of DLLs commonly abused in sideloading attacks and filters out legitimate loads from known system directories to reduce false positives.
Detects remote RPC calls used by SharpHound to map remote connections and local group membership. This rule specifically targets the MS-WKST protocol (Workstation Service Remote Protocol) interface UUID and operation number associated with SharpHound's reconnaissance activities.
This rule detects attempts to enumerate local system groups on Linux. Adversaries often perform this discovery technique to understand the environment and identify users with elevated permissions. The rule triggers on execution of the 'groups' command or on common file viewing utilities (cat, ed, head, less, more, nano, tail, vi, vim) when they are used to read the '/etc/group' file.
Detects the execution of common text-based file access or inspection utilities to read the content of the '/etc/sudoers' file on Linux systems. This activity is often performed by adversaries to discover users with sudo rights, which can be a precursor to privilege escalation.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Identifies when a Kubernetes account accesses sensitive objects such as ConfigMaps or Secrets within Azure Kubernetes Service. This rule specifically looks for write or delete operations on these objects, which could indicate unauthorized access or malicious activity.
Detects attempts to record audio using the `arecord` and `ecasound` utilities on Linux systems. This rule specifically looks for the execution of `arecord` with common audio recording flags (`-vv`, `-fdat`) or the `ecasound` utility making a `memfd_create` syscall, which could indicate audio processing or recording.
This rule detects when an executable file (.exe) creates another executable file (.exe). This behavior can be indicative of malicious activity such as malware dropping its components, or legitimate software installers. The rule includes extensive filters to reduce false positives from common system processes, update utilities, and known application behaviors like those from Microsoft Teams, VS Code, and GitHub Desktop.
This rule identifies when sensitive ClusterRoles or Roles are being modified, deleted, or when their permissions are being escalated or bound in Azure Kubernetes Service (AKS). These operations can indicate an attempt to gain elevated privileges or disrupt access within the Kubernetes cluster.
This rule detects the execution of SharpView, a .NET port of PowerView, which is a popular PowerShell tool used for Active Directory reconnaissance. The rule specifically looks for the `SharpView.exe` executable or its command-line arguments containing various reconnaissance functions. These functions are commonly used by adversaries to discover information about domain computers, users, groups, trusts, policies, and network shares within an Active Directory environment.
Page 316 of 680