SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,743 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the creation of files with a double extension where the second extension is ".lnk" and the first extension is commonly associated with documents or images. This technique is often used by malware to masquerade malicious LNK files as benign documents or images, exploiting the default Windows behavior of hiding known file extensions.
Detects potential exploitation attempts of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager. The rule specifically looks for PowerShell or cmd.exe processes being spawned as child processes of the legitimate Tomcat "prunsrv.exe" process, which was observed as part of the attack chain by Morphisec.
Detects when AWS S3 bucket versioning is disabled. This action can be a precursor to data deletion or modification without the ability to recover previous versions, often seen in ransomware attacks targeting cloud storage.
This rule detects the creation or activation of new user accounts in Okta with specific display names, such as 'svc_network_backup', which were identified as indicators of compromise during the Okta Support System 2023 breach. It aims to flag suspicious account activity that could indicate unauthorized access or persistence by an attacker. The rule can be improved by filtering out legitimate usernames if 'svc_network_backup' is a known and authorized account in the environment.
Detects the creation of an HTA file in the Windows Startup folder by FoxitPDFReader. This activity is indicative of potential exploitation of CVE-2023-27363, a vulnerability in Foxit Reader that could allow an attacker to achieve persistence by placing a malicious HTA file in a location that executes upon user login.
Detects the use of "vim" and its sibling commands (rvim, vimdiff) to execute a shell or proxy commands. This behavior can be indicative of privilege escalation, unauthorized command execution, or attempts to break out of restricted environments by leveraging the capabilities of these text editors to run arbitrary commands or scripts (e.g., via :!/, :lua, :py, or direct shell calls).
This rule detects exploitation indicators for CVE-2023-20198, a privilege escalation vulnerability in Cisco IOS XE Software Web UI. It looks for specific log messages related to Web UI installation operations, system configuration changes, or successful web logins, in conjunction with the use of specific user accounts ('cisco_tac_admin', 'cisco_support', 'cisco_sys_manager') that are not typically created by default or used by Cisco representatives. The combination of these events suggests an attempt to exploit the vulnerability.
Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles. The rule specifically looks for child processes with suspicious image names (e.g., calc.exe, regsvr32.exe, rundll32.exe, cscript.exe, wscript.exe), PowerShell or command prompt processes executing suspicious commands (e.g., Invoke-Expressions, IEX, Invoke-Command, DownloadString, rundll32, regsvr32, wscript, cscript), or child processes launched from suspicious paths (e.g., C:\Users\Public\, C:\Windows\Temp\, C:\Temp\).
Detects potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network. This event is best correlated and used as an enrichment to determine the potential lateral movement activity.
This rule detects process creation events where the command line contains a specific, unique string ' uTYNkfKxHiZrx3KJ'. This string is identified as an indicator of compromise associated with the Diamond Sleet APT group, also known as Lazarus Group. The rule aims to identify execution of malicious payloads or commands used by this threat actor.
Page 397 of 680