SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,770 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0".
Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Detects when a user attached a Lambda layer to an existing Lambda function.
A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role.
This would give an adversary access to resources that the function has access to.
A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role.
This would give an adversary access to resources that the function has access to.
Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.
Detects the execution of whoami.exe with suspicious parent processes.
Detects suspicious file creations within the Palo Alto Networks PAN-OS' parent telemetry folder, specifically looking for filenames containing patterns indicative of OS command injection attempts related to CVE-2024-3400. These files are processed by the 'dt_curl' script, which can lead to arbitrary command execution if device telemetry is enabled and filenames are crafted to bypass shell-subprocess restrictions.
Detects the creation of Python path configuration files (.pth) within Python library folders on Windows systems. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are imported by the calling script. The rule specifically targets files ending with '.pth' in paths matching '\(venv|python(.+)?)\lib\site-packages\', while filtering out known legitimate .pth files like 'pywin32.pth' and 'distutils-precedence.pth'.
Detects the creation of Python path configuration files (.pth) within Python library folders on macOS. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are explicitly imported by a script. The rule specifically looks for files ending with '.pth' in the '/lib/python3.([5-9]|[0-9]{2})/site-packages/' directory structure.
Detects the creation of Python path configuration files (.pth) within Python library folders on Linux systems. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are imported by the calling script. The rule specifically looks for files ending with '.pth' in typical Python site-packages directories.
Detects potential exploitation attempts of CVE-2024-3400, an OS command injection vulnerability in Palo Alto GlobalProtect. The rule looks for suspicious strings indicating directory traversal or command injection within Palo Alto GlobalProtect logs.
Page 356 of 680