SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,768 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects a network connection that was initiated from a PowerShell process. Malicious PowerShell scripts often download additional payloads or communicate back to command and control channels via uncommon ports or IPs. This rule can be used as a basis for hunting for anomalies.
This rule detects the execution of rundll32.exe with a command line that does not specify a common DLL extension (.cpl, .dll, .inf). Adversaries often use rundll32.exe to execute malicious code, and by using uncommon or no extensions, they attempt to evade detection mechanisms that might look for standard rundll32.exe usage. The rule filters out known legitimate uses of rundll32.exe, such as those involving common extensions, local server invocations, MSIExec processes, and specific Microsoft EdgeUpdate processes.
This rule detects when an OpenCanary honeypot receives a Session Initiation Protocol (SIP) request. OpenCanary is a honeypot designed to detect unauthorized activity by mimicking vulnerable services. A SIP request to an OpenCanary node indicates that an attacker or scanner has interacted with the emulated SIP service, which is typically an indicator of reconnaissance or an attempted attack against voice-over-IP (VoIP) infrastructure.
Detects tampering with the "Enabled" registry key to disable Windows event logging for a specific event channel. This activity is often performed by adversaries to evade detection by security tools and analysts.
This rule detects when the Windows Defender service (WinDefend) is disabled by modifying its 'Start' registry key. This is a common technique used by attackers or malware to impair defenses and avoid detection.
Detects changes to the "MaxMpxCt" registry value, which specifies the maximum outstanding network requests for the server per client when negotiating an SMB connection. Ransomware threat actors, specifically BlackCat, have been observed increasing this value to handle a higher volume of traffic, potentially for data exfiltration or other high-volume network activities.
This rule detects indicators of potential exploitation of CVE-2023-27997, a critical Fortigate SSL VPN vulnerability. It specifically looks for GET or POST requests to '/remote/hostcheck_validate' or '/remote/logincheck' URIs that also contain the 'enc=' parameter in the query string. These patterns are associated with attempts to exploit the vulnerability.
ServiceDLL Hijack
Sigma
Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence by adversaries to execute malicious payloads as part of persistence or privilege escalation. The rule specifically looks for modifications to the ServiceDll registry key within the Windows Services hive, while filtering out common legitimate modifications related to printing, domain controllers, and system updates.
Detects exploitation attempts of the OWASSRF variant targeting Exchange servers. This variant uses the OWA endpoint to access the PowerShell backend endpoint, indicated by specific URI patterns and HTTP methods. The rule filters out common legitimate user agents to reduce false positives.
This rule detects attempts to change the 'Altitude' registry value for the Sysmon driver instance. Modifying this value can prevent Sysmon from loading correctly at boot if the new altitude conflicts with other registered services, effectively disabling or impairing its monitoring capabilities. This technique is often used by adversaries to evade detection.
Page 363 of 680