SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,777 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.
Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have been known to use this technique to extract sensitive information from the registry.
This rule detects processes that query known third-party application registry keys that are known to store credentials. The detection specifically looks for command-line arguments containing paths to registry keys associated with applications like Foxmail, DownloadManager, CoreFTP, IncrediMail, WinSCP, MobaXterm, OpenSSH, OpenVPN, Radmin, Eudora, RealVNC, B2, PuTTY, and TightVNC. This activity often indicates an adversary attempting to discover or extract credentials stored by these applications.
Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.
Detects the loading of specific DLLs associated with Katz Stealer malware, particularly variants from 2025. The presence and loading of these DLLs strongly indicate malicious activity on the system, as Katz Stealer is known for stealing sensitive information.
Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant known for stealing sensitive information. In enterprise environments, such DNS queries may indicate potential malicious activity or compromise.
Detects attempts to execute remote commands, within a Pod's container using e.g. the "kubectl exec" command.
Detects enumeration of Kubernetes secrets.
Detects attempts to inject a sidecar container into a running deployment.
A sidecar container is an additional container within a pod, that resides alongside the main container.
One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation.
By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.
A sidecar container is an additional container within a pod, that resides alongside the main container.
One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation.
By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.
Detects instances where an FTP service on an OpenCanary node has had a login attempt.
Page 331 of 680