SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,766 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects code integrity failures such as missing page hashes or corrupted drivers due to unauthorized modification. This could be a sign of tampered binaries, which adversaries might use for defense evasion or to maintain persistence.
Detects exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The rule specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' with an unusually long 'cs-host' header string, which is characteristic of the exploit.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center / Confluence Server. This vulnerability allows an attacker to create admin accounts and execute arbitrary commands. The rule specifically looks for suspicious child processes like bash, curl, or wget being spawned by the Confluence Java process.
This rule detects file modifications to ASPX and ASHX files within the root of the 'App_Extensions' directory by the 'ScreenConnect.Service.exe' process. This activity is indicative of exploitation of CVE-2024-1708, a ZipSlip vulnerability in ConnectWise ScreenConnect versions prior to 23.9.8, which allows for path traversal and arbitrary file write.
This rule detects the creation of specific configuration files (`.conf`) in the `AppData\Roaming` directory, which have been observed in the wild to be associated with Remote Access Trojans (RATs) such as VenomRAT, AsyncRAT, and Lumma Stealer. The rule looks for files ending with `datalogs.conf`, `hvnc.conf`, or `dcrat.conf` within subdirectories like `mydata`, `datalogs`, `hvnc`, or `dcrat` under `AppData\Roaming`.
Detects modifications to the 'ms-msdt' URI scheme in the Windows Registry, specifically when the 'TargetObject' starts with 'HKCR\ms-msdt\'. This activity could indicate an attempt to exploit CVE-2022-30190, a Microsoft Support Diagnostic Tool (MSDT) vulnerability, often referred to as "Follina". The vulnerability allows for remote code execution via specially crafted Microsoft Office documents.
Detects exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The detection logic specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' with an unusually long host header string (150 characters or more) in proxy logs. This pattern is indicative of the 'Citrix Bleed' exploit.
Detects exploitation attempts of the OWASSRF vulnerability targeting Microsoft Exchange servers using publicly available Proof-of-Concept (POC) code. This exploit leverages the Outlook Web Access (OWA) endpoint to gain access to the PowerShell backend endpoint, indicated by specific URI patterns, HTTP method, user-agent, and a successful HTTP status code.
Detects command line patterns used by BlackByte ransomware in different operations, including execution from the Public user directory, attempts to delete Task Manager, disable services, and use obfuscated PowerShell commands.
This rule detects the creation, modification, or deletion of scheduled tasks using specific task names known to be associated with the SVR-attributed GraphicalProton backdoor. The task names are designed to mimic legitimate Windows services to evade detection.
Page 365 of 680