SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,767 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects remote procedure calls (RPC) specifically targeting the Remote Registry Protocol (MS-RRP) interface (UUID: 338cd001-2244-31f1-aaaa-900038001003) for information collection. It filters out common administrative operations (OpNum 6, 7, 8, 13, 18, 19, 21, 22, 23, 35) to reduce false positives, focusing on suspicious reconnaissance activities against the registry from a remote system.
Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.). This often indicates an attempt to execute malicious code via Office applications, leveraging common living-off-the-land binaries (LOLBINs) or other suspicious executables.
Detects instances where an FTP service on an OpenCanary honeypot has had a login attempt. This indicates an adversary is attempting to access or interact with the honeypot's services, which could be part of reconnaissance, initial access, or lateral movement activities.
This rule detects a specific lateral movement technique leveraging the MMC20.Application COM object. It identifies instances where 'mmc.exe' is spawned as a child process of 'svchost.exe' with the command line argument '-Embedding'. This behavior is indicative of the MMC20.Application COM object being used for remote code execution, often for lateral movement within a network.
Detects exploitation attempts targeting Arcadyan routers, specifically looking for path traversal (CVE-2021-20090) and configuration file injection (CVE-2021-20091) vulnerabilities. The rule identifies requests containing '..%2f' (URL-encoded path traversal) and, for the configuration file injection, also 'apply_abstract.cgi', combined with requests to unauthenticated paths.
Detects potential exploitation of CVE-2021-26084, a Confluence RCE using OGNL injection. The rule looks for specific POST requests to Confluence endpoints, either '/pages/createpage-entervariables.action' with a 'SpaceKey=x' parameter or '/doenterpagevariables.action' with a 'u0027' string in the POST body's 'queryString' parameter. It specifically targets requests from 'anonymous' users that result in a 200 HTTP status code.
Detects log entries that appear in exploitation attempts against Microsoft Exchange Remote Code Execution vulnerability CVE-2021-42321. Specifically, it looks for Event IDs 6 or 8 from the msexchange-management service containing specific error messages related to cmdlet failures or unhandled exceptions during Get-App operations, which are indicative of the exploitation.
Detects suspicious child processes spawned by 'pc-app.exe', which is the main application executable for PaperCut MF/NG. The presence of common system utilities and scripting interpreters as child processes of 'pc-app.exe' can indicate successful exploitation of a vulnerability within PaperCut, potentially leading to arbitrary code execution.
This rule detects remote RPC calls specifically targeting the Task Scheduler service (SASec) to read information about scheduled tasks. This activity is often associated with reconnaissance by adversaries attempting to understand the environment's scheduled jobs.
This rule detects buffer overflow attempts in Unix system log files by looking for specific keywords. These keywords include phrases indicating an attempt to execute code on the stack, known exploit strings like '0bin0sh1', a long string of 'A's (which can be indicative of buffer filling), and messages related to 'stack smashing detected'. The rule aims to identify malicious activity where an attacker tries to overflow a buffer to gain control of program execution, potentially leading to privilege escalation.
Page 321 of 680