SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,773 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of the "esxcli" command with the "vm" and "kill" flags, indicating an attempt to terminate or shut down a specific virtual machine on an ESXi hypervisor. This activity can be indicative of malicious actions such as ransomware attacks targeting virtualized environments.
Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.
Detects the execution of RemoteKrbRelay, a tool used for Kerberos relaying attacks. The rule identifies the tool based on its executable name or original filename and various command-line arguments that indicate different Kerberos relaying attack techniques such as relaying to SMB, LDAP for RBCD (Resource-Based Constrained Delegation), changing user passwords, or adding users to groups.
This rule detects the launch of web browsers (both Chromium-based and Firefox) with command-line arguments that enable remote debugging. This functionality, while legitimate for developers, can be abused by attackers to inject malicious code, steal credentials, or perform browser session hijacking. The rule specifically looks for '--remote-debugging-' in Chromium-based browsers and '-start-debugger-server' in Firefox.
Detects potentially suspicious child processes spawned by the SSH daemon (sshd) that execute commands using 'bash -c' or 'sh -c' as the root user. This behavior is indicative of potential exploitation of CVE-2024-3094, a backdoor in the XZ Utils library.
Detects the creation of a new user account on an ESXi system using the 'esxcli' command-line interface. This activity can be an indicator of an adversary establishing persistence or gaining unauthorized access to the hypervisor.
Detects when a Kubernetes Rolebinding is created or modified.
Detects suspicious SQL query keywords that are often used during reconnaissance, data exfiltration, or destructive activities. This includes keywords like 'drop', 'truncate', 'dump', and 'select *', which can indicate attempts to manipulate database structures, extract sensitive information, or perform denial-of-service attacks.
Detects the execution of the 'esxcli' command with the 'vm' flag to retrieve information about installed virtual machines on an ESXi hypervisor. This activity can be part of discovery phase by adversaries targeting ESXi environments.
Detects the execution of the "esxcli" command with the "network" flag to retrieve information about the network configuration on an ESXi host. This activity can be indicative of an adversary performing discovery.
Page 333 of 680