SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,767 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. Attackers can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files, which can be abused for persistence. The rule specifically looks for modifications to registry keys related to PersistentHandler and CLSID, while filtering out known legitimate system paths and default IFilter CLSIDs to reduce false positives.
Detects the creation of files with suspicious extensions (e.g., .bat, .dll, .exe, .hta, .js, .ps1, .vbe, .vbs) within the Windows Public user folder. This activity can indicate an adversary staging malicious scripts or binaries in a location accessible to all users, potentially for execution or further distribution.
Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges
Detects the execution of `cmd.exe` with output redirection (`>`) to suspicious locations such as temporary directories, user profile directories, or `ProgramData`. This technique is often used by adversaries to save the output of reconnaissance commands (e.g., `hostname`, `dir`) to files for later exfiltration, helping them evade immediate detection by storing command output in less scrutinized locations.
Detects the execution of a renamed "NirCmd.exe" binary based on its original filename metadata. This rule specifically looks for instances where the 'OriginalFileName' field in the process creation event is 'NirCmd.exe', but the actual executed image path does not end with 'nircmd.exe' or 'nircmdc.exe'. This indicates an attempt to evade detection by renaming the legitimate NirCmd utility.
This rule detects access to the 'wceaux.dll' file, which is associated with the Windows Credential Editor (WCE) tool. This activity is indicative of an attempt to perform pass-the-hash remote command execution, often used for credential dumping and lateral movement. The rule specifically looks for Security Event IDs 4656 (A handle to an object was requested) or 4663 (An attempt was made to access an object) where the accessed object's name ends with '\wceaux.dll'.
Detects exploitation activity of CVE-2023-46747, an unauthenticated remote code execution vulnerability in F5 BIG-IP. The rule looks for specific POST requests to '/mgmt/tm/util/bash' containing keywords related to form submission and user creation within the F5 BIG-IP Traffic Management User Interface (TMUI).
Detects potential exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The rule specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' that result in a 200 HTTP status code, indicating a successful attempt to access this specific endpoint which is part of the vulnerability exploitation chain.
Detects exploitation activity targeting CVE-2023-46747, an unauthenticated remote code execution vulnerability in F5 BIG-IP. The rule specifically looks for POST requests to '/mgmt/tm/util/bash' containing hex-encoded or plain text strings related to '/tmui/Control/form' and 'form_page=%2ftmui%2fsystem%2fuser%2fcreate.jsp', which are indicators of the exploit attempting to create a new user.
Detects potential exploitation attempt of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability, via proxy logs. This vulnerability allows for the disclosure of sensitive information, such as session tokens.
Page 364 of 680