SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,774 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files before deletion, specifically files ending with '.AAA' or '.ZZZ'.
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.). This technique is often used to dump LSASS memory for credential access.
Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250. This vulnerability allows for privilege escalation.
Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec
Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.
This rule detects the execution of 'rundll32.exe' with command-line arguments that suggest an obfuscated ordinal call. Ordinal calls are a way to execute functions within a DLL by their numerical index rather than their name. Adversaries may obfuscate these ordinal numbers by adding leading zeros or using large numbers that wrap around due to 16-bit integer limitations, making the command line harder to analyze and potentially bypassing signature-based detections.
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File System (CLFS) driver vulnerabilities. The rule identifies processes loading 'clfs.sys' from common temporary or user-writable directories often abused by malware or exploits.
Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used.
This may indicate an attacker attempting to leverage credentials they have obtained.
This may indicate an attacker attempting to leverage credentials they have obtained.
Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.
Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity.
Page 358 of 680