SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,766 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detection rule generated by AI system
This rule detects potential secure deletion activity using SDelete by monitoring Windows Security Event IDs 4656, 4663, and 4658 for file objects ending with '.AAA' or '.ZZZ'. These extensions are commonly associated with SDelete's file wiping process, where it renames files with these extensions during secure deletion to prevent recovery.
Detects the execution of command-line utilities such as 'kill', 'pkill', 'killall', or 'xkill' to terminate or send signals to running processes on a Linux system. This activity can be indicative of an adversary attempting to disrupt services, evade defenses, or clean up their tracks.
Detects enumeration of local system accounts on Linux. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. The rule identifies common commands and file accesses used for this purpose, such as 'lastlog', 'id', 'lsof -u', and utilities like 'cat', 'head', 'tail' accessing '/etc/passwd', '/etc/shadow', or '/etc/sudoers'.
Detects PowerShell execution that utilizes the bitwise XOR (bxor) operator. Attackers may use this as an alternative obfuscation method to Base64 encoded commands to evade detection. Investigation of the command line and process tree is recommended to determine if the activity is malicious.
This rule detects the execution of common Linux utilities used for process discovery. Adversaries often use these commands (atop, htop, pgrep, ps, pstree, top) to gather information about running processes on a system, which helps them understand the environment and plan subsequent actions. This information can reveal common software or applications running on systems within the network.
Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls.
This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.
This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.
Detects modifications to an AWS RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information. These actions can be performed by an attacker to disrupt services, remove evidence, or facilitate data theft.
Detects potential use of Rubeus via registered new trusted logon process
Detects attempts to query the contents of the event log using command line utilities such as `wevtutil.exe`, `wmic.exe`, and PowerShell cmdlets like `Get-WinEvent` or `Get-EventLog`. Attackers use this technique to find sensitive information in logs, such as credentials, usernames, or IP addresses.
Page 372 of 680