SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,774 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of 'netscan.exe' from SoftPerfect, a network scanning application. This tool is frequently used by threat actors for network reconnaissance to map out network architecture within compromised environments.
This rule detects the use of PowerShell in conjunction with nslookup to create a download cradle. This technique leverages nslookup to extract payloads from DNS TXT records, which are then processed by PowerShell. This is a known method for adversaries to download malicious content while potentially evading traditional network defenses by using DNS for data transfer.
Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained.
Detects the installation of the AnyDesk remote access software service. This could indicate abuse if AnyDesk is not legitimately used within the environment. The rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, where the service name or image path contains 'AnyDesk' and the service name also contains 'Service'.
Detects HTTP requests to low reputation Top-Level Domains (TLDs) or for files with suspicious extensions, which may indicate an attempt to download malicious content or establish command and control.
Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network. This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT.
Detects the creation of JavaScript files within the Windows DriverStore directory. This activity has been observed in attacks by the Forest Blizzard APT (also known as Star Blizzard) to exploit CVE-2022-38028 in the Windows Print Spooler service. The adversary modified a JavaScript constraints file and executed it with SYSTEM-level permissions to achieve privilege escalation and credential access.
Detects the execution of Notepad to open a file that has the string "password" in its name and a common extension (txt, csv, doc, xls). This activity may indicate unauthorized access to credentials or suspicious reconnaissance.
Detects the 'RegAsm.exe' utility initiating an outbound network connection to a public IP address. RegAsm.exe is a legitimate Microsoft utility used to register .NET assemblies, but it can be abused by adversaries for defense evasion and proxy execution, especially when making unexpected network connections.
Detects the deletion of files commonly used for backups by adversaries to prevent system recovery. This rule specifically looks for deletion actions performed by common Windows command-line interpreters and system utilities on files with backup-related extensions.
Page 357 of 680