SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,770 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects instances where a TFTP service on an OpenCanary honeypot node has received a request. This indicates potential reconnaissance or attempts to interact with a seemingly vulnerable service.
Detects instances where an HTTP service on an OpenCanary honeypot has received a GET request. This indicates an adversary is interacting with the honeypot, likely as part of reconnaissance or initial access attempts.
This rule detects HTTP POST login attempts against an OpenCanary honeypot. OpenCanary is a honeypot designed to mimic various services to detect unauthorized access attempts. A 'logtype' of 3001 specifically indicates an HTTP service login attempt via a form POST, suggesting an adversary is trying to gain initial access or credentials by interacting with the emulated service.
Detects instances where an SMB service on an OpenCanary honeypot node has received a file open request. This indicates an adversary is interacting with the honeypot's SMB share, potentially attempting to discover or access files.
Detects instances where a VNC service on an OpenCanary node has had a connection attempt. This indicates an adversary attempting to connect to a VNC service, likely for remote access or reconnaissance.
Detects the creation of new files with the ".evtx" extension in non-common or non-standard locations. This could indicate tampering with default EVTX locations to evade security controls or exfiltration of event logs to search for sensitive information. Note that backup software and legitimate administrators might perform similar actions during troubleshooting.
Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values to disable the showing of hidden files and system files. This technique is often abused by malware to hide its files from users.
Detects the execution of a Word document via the WinWord Start Menu shortcut using `cmd.exe`. This behavior has been observed in KamiKakaBot samples to initiate the second stage of infection. The rule specifically looks for `cmd.exe` executing a command line that includes a `.lnk` file, a path containing `Start Menu\Programs\Word`, and a `.doc` file extension.
This rule detects when an OpenCanary honeypot's NTP service receives a 'monlist' request. The 'monlist' command is a deprecated feature in NTP that can be abused for amplification attacks (Network Denial of Service). Detecting this activity on a honeypot indicates an adversary is likely scanning for vulnerable NTP servers or attempting to use the honeypot in an amplification attack.
Detects the creation of a scheduled task that runs weekly and executes the "shutdown /l /f" command. This behavior has been observed being used by KamiKakaBot samples to achieve persistence on a system.
Page 362 of 680