SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,767 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Detects instances where an SNMP service on an OpenCanary node has had an OID request.
Detects suspicious user agent strings commonly used by exploit and penetration testing frameworks such as Metasploit, Cobalt Strike, Empire, and Havoc. These user agents often mimic legitimate browsers or applications but contain specific patterns that indicate their use by these tools. The rule is designed to identify command and control (C2) communication or initial access attempts originating from these frameworks by analyzing proxy logs.
Detects instances where a GIT service on an OpenCanary node has had Git Clone request.
Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.
Detects instances where a MySQL service on an OpenCanary node has had a login attempt.
Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.
Detects instances where an SIP service on an OpenCanary node has had a SIP request.
Detects instances where a TFTP service on an OpenCanary node has had a request.
Detects instances where a VNC service on an OpenCanary node has had a connection attempt.
Page 368 of 680