SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,767 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation or modification of a DLL path within the Windows Time service (W32Time) TimeProviders registry key. Adversaries may abuse this mechanism to establish persistence by registering a malicious DLL to be loaded and executed when the system boots. The rule specifically looks for changes to the 'DllName' value under 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders' and filters out known legitimate DLLs associated with the W32Time service.
Detects potential exploitation of CVE-2024-1212, an unauthenticated command injection vulnerability in Progress Kemp LoadMaster. The rule specifically looks for GET requests to the '/access/set' API with the parameters 'param=enableapi' and 'value=1', combined with an "Authorization" header containing a base64 encoded value with uncommon characters, indicative of an attempted exploit.
Detects instances where a MySQL service on an OpenCanary honeypot has had a login attempt. This indicates an adversary is attempting to gain unauthorized access to the honeypot's emulated MySQL service, which can be a sign of reconnaissance or credential stuffing activities.
This rule detects attempts to modify the "ChannelAccess" registry key, which controls access permissions for Windows event channels. Adversaries may tamper with these permissions to prevent security tools or analysts from accessing event logs, thereby hindering detection and forensic analysis. The rule specifically looks for modifications to the 'ChannelAccess' key within the 'WINEVT\Channels' registry path and identifies specific Security Descriptor Definition Language (SDDL) strings that grant 'GENERIC ALL' or 'GENERIC WRITE' permissions to local administrators, local system, or built-in administrators. This activity is often a precursor to clearing event logs or otherwise impairing defenses.
Detects usage of NimScan, a portscanner utility.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
This rule detects when a Git clone request is made to a Git service running on an OpenCanary honeypot. This indicates an adversary is interacting with the honeypot, likely attempting to collect information or test access.
Detects instances where an MSSQL service on an OpenCanary honeypot node has had a login attempt using Windows Authentication. This indicates an adversary is attempting to authenticate against a honeypot, which is highly suspicious.
This rule detects when an SNMP OID request is made to an OpenCanary honeypot's SNMP service. This indicates an adversary is likely performing reconnaissance to gather information about the network or devices, potentially looking for vulnerabilities or sensitive data.
Detects suspicious PowerShell invocation command parameters
Detects suspicious PowerShell invocation command parameters
Page 361 of 680