SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,761 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of IOX - a tool for port forwarding and intranet proxy purposes
Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.
Detects highly relevant antivirus alerts indicating the presence of hack tools or other attack tools. This rule emphasizes that even if the antivirus blocks the malware, the event requires investigation to understand how the tool initially compromised the system.
Detects a Python process attempting to spawn a pseudo-terminal (TTY) using the `pty` module. This behavior is often indicative of an attacker establishing a reverse shell for interactive command execution on a compromised system. The rule specifically looks for Python executables and command-line arguments that import the `pty` module and call its `spawn` function.
This rule detects highly relevant antivirus alerts that specifically report the presence of a web shell. It is designed to flag antivirus detections where the signature indicates a web shell, often identified by keywords related to common web scripting languages (ASP, PHP, JSP, Perl) and terms like 'Backdoor', 'Webshell', or specific web shell names (C99shell, Chopper). The rule emphasizes that such alerts, even if the malware is blocked, warrant further investigation into how the web shell was initially placed on the system.
Detects a highly relevant Antivirus alert that reports a password dumper. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects the execution of Python code that imports the 'pty' and 'socket' modules and uses 'spawn' and '.connect' functions, which is a common pattern for establishing a reverse shell.
Detects suspicious DNS queries to known Monero mining pools, indicating potential cryptocurrency mining activity on the network. This rule identifies specific domain names associated with various Monero mining operations.
Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information. This tool is used by adversaries to impair defenses.
Page 383 of 680