SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,743 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of common network scanning and reconnaissance tools on Linux systems. These tools are often used by adversaries to enumerate local or remote network services, identify open ports, and gather information about network topology and available hosts. The rule specifically looks for the execution of tools like netcat (when not in listen mode), nmap, hping, naabu, autorecon, and telnet.
Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP
Detects process access requests from hacktool processes based on their default image name
Detects suspicious parent process for cmd.exe
Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.
Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.
Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors
Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.
Detects the creation of a specific file path commonly used in Proof-of-Concept (PoC) exploits for the Print Spooler vulnerability CVE-2021-1675, also known as PrintNightmare. This file path is typically created when an attacker successfully exploits the vulnerability to achieve remote code execution or privilege escalation.
Page 394 of 680