SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,777 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.
Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.
Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32.
Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.
Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.
Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection.
Detects the execution of the 'esxcli' command with the 'storage' flag to retrieve information about storage status on VMware ESXi systems. This activity has been observed in malware campaigns, including DarkSide and LockBit ransomware.
Detects the execution of the "esxcli" command with the "vsan" flag to gather information about virtual storage on VMware ESXi systems. This activity has been observed in malware campaigns, including DarkSide and LockBit ransomware, indicating potential reconnaissance or preparation for impact on virtualized environments.
Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0. CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass, which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through template injection. This sequence enables unauthenticated remote code execution, significantly increasing the impact of exploitation.
This rule detects suspicious usage of the 'curl' command on Linux systems that indicates a file upload or data transfer to a web service. It specifically looks for the 'curl' executable being run with command-line arguments such as '--form', '--upload-file', '--data', or their variations ('--data-ascii', '--data-binary', '--data-raw', '--data-urlencode'), or the shorthand options '-F', '-T', '-d'. The rule filters out connections to localhost or 127.0.0.1 to reduce false positives from legitimate local development or testing activities.
Detects the Kapeka Backdoor binary being loaded by rundll32.exe. The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In. The rule specifically looks for rundll32.exe loading a DLL with a '.wll' extension from common user-writable directories like ProgramData or AppData\Local.
Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID. This event can be leveraged by adversaries to obtain crash dumps which may contain sensitive information, including credentials.
Page 338 of 680