SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,767 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects file modifications to the temporary XML user database file in the ScreenConnect server. This activity can indicate local user modification, potentially as part of the exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8. It may also be observed during legitimate modifications to local users or permissions within ScreenConnect.
Detects GET requests to '/SetupWizard.aspx/[anythinghere]' that indicate exploitation of the ScreenConnect vulnerability CVE-2024-1709, which is an authentication bypass vulnerability.
Detects the execution of the Qakbot uninstaller file, identified by its filename or specific file hashes, as mentioned in the USAO-CDCA document regarding the disruption of the Qakbot malware and botnet. This rule helps identify systems where the Qakbot uninstaller has been run, which could indicate remediation efforts or system compromise.
This rule detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is indicative of exploitation of CVE-2024-1708, a path traversal vulnerability (ZipSlip) in ConnectWise ScreenConnect versions prior to 23.9.8. The detection relies on Windows Event ID 4663 (File System) with a SACL set on the directory to log successful access attempts.
Detects the execution of specific processes and command line combinations associated with the Forest Blizzard APT group. This includes the creation and deletion of scheduled tasks using 'schtasks.exe' and PowerShell commands for file operations, as described by Microsoft.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center / Confluence Server, where an attacker can exploit vulnerable endpoints to create admin accounts and execute arbitrary commands. Specifically, this rule looks for suspicious child processes like cmd.exe or powershell.exe being spawned by Tomcat processes associated with Confluence.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center and Confluence Server. This vulnerability allows an attacker to exploit specific endpoints to potentially create administrator accounts and execute arbitrary commands. The rule identifies POST requests to known vulnerable URIs associated with setup and restore actions, or server information, which are indicative of an exploitation attempt.
Detects exploitation attempts of CVE-2023-46214, a remote code execution (RCE) vulnerability in Splunk Enterprise. The rule specifically looks for patterns associated with known public proof-of-concept (POC) code that leverages insecure XML parsing. It identifies POST requests to specific Splunk API endpoints (`/splunkd/__upload/indexing/preview` or `/api/search/jobs/results`) with particular URI query parameters (`NO_BINARY_CHECK=1`, `input.path=shell.xsl`, `/opt/splunk/var/run/splunk/dispatch/`, `/shell.xsl`) that indicate an attempt to upload and execute a malicious XSL stylesheet.
Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity. The rule looks for rundll32.exe being spawned by common scripting or execution processes (cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, wscript.exe) and executing a file in common temporary or user-writable directories (ProgramData, Users\Public, Windows\Installer, AppData\Local\Temp, AppData\Roaming) where the file being executed does not have a standard DLL, CPL, or INF extension.
This rule detects the creation, modification, or deletion of scheduled tasks with specific names known to be used by the SVR-affiliated GraphicalProton backdoor. The rule monitors Windows Security Event IDs 4698 (A scheduled task was created), 4699 (A scheduled task was deleted), and 4702 (A scheduled task was updated) for a predefined list of suspicious task names.
Page 366 of 680