SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,767 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects possible command execution by a web application or web shell by monitoring `execve` and `execveat` syscalls initiated by the web server's user ID (e.g., euid 33 for www-data). This rule specifically targets Linux systems using auditd for logging, requiring a specific auditd configuration to capture these events.
Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. The rule specifically looks for signatures containing common ransomware family names and keywords.
Detects the use of the `sysinfo` system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools might leverage `sysinfo` to fingerprint the system, gathering data to determine if it's a viable target.
This rule detects attempts to execute files from external WebDAV shares. It specifically looks for HTTP GET requests where the User-Agent header starts with 'Microsoft-WebDAV-MiniRedir/' and the requested URI ends with common executable or script file extensions. This behavior is often observed in initial access campaigns where adversaries leverage WebDAV to deliver and execute malicious payloads.
This rule detects the use of the '::FromBase64String(' function in a command line, which is a common method for decoding Base64 encoded strings in PowerShell. Adversaries often use Base64 encoding to obfuscate malicious commands or payloads, making them harder to detect by signature-based defenses. This detection aims to identify attempts to deobfuscate such encoded content, typically as part of a larger attack chain involving defense evasion and execution.
Detects suspicious attempts to download files from legitimate Microsoft domains (Outlook and OneNote) using command-line tools or PowerShell. Adversaries may leverage these trusted domains to host malicious files, bypassing traditional perimeter defenses and making the activity appear legitimate. The rule specifically looks for common download utilities like curl, wget, Invoke-WebRequest, and Start-BitsTransfer in conjunction with specific Microsoft attachment/sync domains.
Detects the creation of temporary files with specific naming conventions (8 alphanumeric characters followed by '.tmp') in the 'C:\Windows\System32\' directory, when the creating process is 'svchost.exe'. This pattern is indicative of remote credential dumping activity often associated with tools like CrackMapExec and Impacket-secretsdump, which use svchost.exe to write temporary files containing dumped credentials.
Detects attempts to inject a sidecar container into a running Kubernetes deployment. This is achieved by monitoring for 'patch' operations on 'deployments' resources within the 'apps' API group. An attacker might use this technique to run their code and hide activity within a legitimate pod, rather than deploying a separate, potentially more conspicuous, pod.
This rule detects connections to an RDP listener where the source IP address is not a private or link-local IP address. This indicates that the RDP service is publicly accessible from the internet, which is generally not recommended due to security risks.
Detects DNS queries initiated by "QuickAssist.exe" to the Microsoft Quick Assist primary endpoint. This activity is often associated with social engineering attacks leading to ransomware, where threat actors misuse Quick Assist to gain remote access to a victim's system.
Page 317 of 680