SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,777 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests. The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.
Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique is used by threat actors and ransomware strains to evade defenses by removing forensic evidence.
Detects the dropping and potential execution of DarkGate loader components, specifically AutoIt scripts (.au3) or compiled AutoIt executables (autoit3.exe), within the C:\temp directory. This activity is indicative of DarkGate malware infection attempts, often leveraging vulnerabilities like CVE-2024-21412.
Detects programs that connect to known malware callback ports based on threat intelligence reports. This rule specifically targets Linux systems and filters out connections to common local IP ranges to reduce false positives.
Detects the execution of the `nscurl` utility on macOS with command-line arguments indicative of file download operations. This can be used by adversaries to transfer tools or other files into a compromised environment.
This rule detects the execution of the 'sysctl' command on macOS with specific arguments ('hw.', 'kern.', or 'machdep.'). Threat actors and malware commonly use 'sysctl' with these arguments to gather system hardware information, often as part of virtualization or sandbox evasion techniques. By querying system properties, adversaries can determine if they are operating in an analysis environment and adjust their behavior accordingly.
Detects when the Time Machine backup utility is disabled on macOS using the `tmutil` command-line tool. This action can be performed by an attacker to prevent system backups, hindering recovery efforts after an attack.
Detects the execution of PowerShell scripts that use the 'Start-NetEventSession' cmdlet to initiate network event and packet capture. This activity can be leveraged by adversaries to sniff network traffic, potentially capturing sensitive information like user credentials, especially when transmitted over unencrypted protocols. This technique is often used for information gathering during an operation.
This rule detects attempts to delete macOS Time Machine backups using the native utility "tmutil" with the 'delete' command. Adversaries may perform this action to prevent victims from restoring their files, often as a precursor to a ransomware attack or other data destruction activities.
Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule". This activity is often associated with defense evasion tactics to allow adversary communications or lateral movement.
Page 350 of 680