SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,767 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of named pipes with specific names known to be used by the Turla APT group. These named pipes include '\atctl', '\comnap', '\iehelper', '\sdlrpc', and '\userpipe'. The rule relies on Sysmon Event ID 17 or 18 for named pipe creation events.
Detects remote RPC calls to get event log information via the EVEN or EVEN6 interfaces, which can be indicative of reconnaissance activity by an attacker. This rule specifically targets RPC Firewall logs for these interface UUIDs.
This rule detects remote procedure call (RPC) activity related to the Print System Remote Protocol (MS-RPRN) and Print System Asynchronous Remote Protocol (MS-PAR) interfaces. Specifically, it looks for RPC Firewall events (EventLog: RPCFW, EventID: 3) where the InterfaceUuid matches known UUIDs associated with these printing protocols. This activity can indicate an attempt to abuse remote printing services for lateral movement within a network, potentially exploiting vulnerabilities like CVE-2021-34527 (PrintNightmare).
This rule identifies when an Azure Kubernetes network policy is modified or deleted. Network policies control the traffic flow between pods/namespaces and to/from external network endpoints. Unauthorized modification or deletion of these policies can lead to security vulnerabilities, such as allowing unauthorized network access to sensitive services or disrupting legitimate communication within the cluster, potentially leading to a denial of service or data exfiltration.
Detects the creation of a process that includes environment variables for HTTP or HTTPS proxy settings in its command line. This can indicate an attempt to route network traffic through a proxy, potentially for command and control or to bypass network restrictions.
This rule detects the creation of a Kubernetes container that includes a hostPath mount. A hostPath volume allows a directory or file from the node to be mounted directly into the container. Attackers with permissions to create pods can leverage writable hostPath volumes to perform container escapes, potentially gaining access to the underlying host node by using techniques like chroot.
Detects the creation of a "privileged" container in Kubernetes. A privileged container has root capabilities on the host, allowing it to access and modify host processes, network operations, IPC calls, file system, mount points, and SELinux configurations. This action can indicate a threat actor attempting container breakout or privilege escalation. The rule specifically looks for 'create' verbs on 'pods' resources where 'capabilities' are present, which implies elevated privileges.
Detects remote RPC calls to potentially abuse the Encrypting File System Remote (EFSR) protocol for lateral movement. This rule specifically looks for events from the RPC Firewall with a particular InterfaceUuid associated with MS-EFSR, indicating an attempt to interact with this service remotely.
Detection rule generated by AI system
Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation. This rule specifically looks for common web server processes (Caddy, Apache HTTPD, Nginx, PHP, Tomcat, IIS, Exchange UMWorkerProcess) or Java processes identified as Tomcat, spawning anomaly children processes like command-line interpreters (cmd.exe, powershell.exe, bash.exe), network utilities (net.exe, netsh.exe), or other system utilities often used in post-exploitation.
Page 320 of 680