SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,767 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects file modifications to the temporary XML user database file within the ScreenConnect server. Such modifications can indicate local user changes, which may occur during the exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions prior to 23.9.8. Legitimate modifications to local users or permissions within ScreenConnect can also trigger this detection. This rule requires Advanced Auditing to log successful Windows Event ID 4663 events and a System Access Control List (SACL) set on the relevant ScreenConnect directory.
Detects the execution of a Control Panel (.CPL) file located in the user's temporary directory via the Shell32 DLL's "Control_RunDLL" export function. This behavior has been observed in multiple Raspberry Robin malware variants.
Detects exploitation attempts of CVE-2023-22518, an improper authorization vulnerability in Confluence Data Center and Server. Attackers can exploit vulnerable endpoints to create admin accounts or execute arbitrary commands. The rule specifically looks for POST requests to known vulnerable URIs associated with setup and restore functionalities.
Detects GET requests to specific files ('/human2.aspx' or '/_human2.aspx') that are known indicators of exploitation attempts targeting the MOVEit Transfer vulnerability CVE-2023-34362. These requests are typically associated with web shell deployment or interaction after initial compromise.
Detects potential exploitation attempts of an undocumented Windows Server pre-authentication Remote Code Execution (RCE) vulnerability. The rule specifically looks for a new 'svchost.exe' process being created by another 'svchost.exe' process, both running with the '-k DHCPServer' command line argument, and under a Network Service account (covering multiple language settings). This pattern indicates an unusual execution flow that could be indicative of an RCE exploit targeting the DHCP Server service.
Detects indicators of exploitation by threat actors during exploitation of the "SlashAndGrab" vulnerability related to ScreenConnect (ConnectWise) as reported by Team Huntress. This rule specifically looks for the creation of known malicious files and paths associated with post-exploitation activities after successful exploitation of CVE-2024-1709 and CVE-2024-1708.
Detects instances where an HTTP service on an OpenCanary node has received a GET request.
Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.
Page 367 of 680