SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,739 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of common network sniffing tools, specifically 'tcpdump' or 'tshark', when they are invoked with arguments indicating an attempt to capture network traffic from a specific interface. The rule looks for the '-c' argument (for count) and the '-i' argument (for interface) in the command line, which are typical indicators of active network sniffing.
Detects the creation of hidden user accounts on macOS. This can occur either by assigning a UserID less than 500 or by explicitly setting the 'IsHidden' option to true during account creation using the 'dscl' command-line utility.
This rule detects when an Azure AD user's credentials have been identified as leaked. This detection is based on the 'leakedCredentials' risk event type reported by Azure AD Identity Protection, indicating that the user's valid credentials (e.g., username and password) have been found on the dark web or other publicly available sources.
Detects when Microsoft Cloud App Security reports that an OAuth application has downloaded multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user. This activity could indicate unauthorized data exfiltration by a compromised or malicious OAuth app.
Detects suspicious and malformed user agent strings in proxy logs that may indicate malicious activity, including the use of specific malware or tools like Cobalt Strike, APT28 malware, Racoon Stealer, and Erbium stealer. The rule identifies various anomalies such as incorrect formatting, typos, and specific user agent strings known to be associated with adversary tools.
This rule detects attempts to access the hidden administrative network share 'ADMIN$' on Windows systems. The 'ADMIN$' share is a default hidden share that maps to the Windows directory (usually C:\Windows) and is primarily used for remote administration. Adversaries often leverage these administrative shares for lateral movement, file transfer, and remote execution within a compromised network. The rule specifically looks for Event ID 5140, which indicates a network share object was accessed, and filters for the 'Admin$' ShareName. It also filters out access from computer accounts (ending with '$') to reduce false positives from legitimate system activities.
Detects suspicious access to Microsoft Teams application's authentication tokens and local storage, which may contain sensitive credentials. This rule specifically looks for Event ID 4663 (Object Access) where the accessed object path contains '\Microsoft\Teams\Cookies' or '\Microsoft\Teams\Local Storage\leveldb', and the accessing process is NOT the legitimate 'Teams.exe'. This indicates an attempt by an unauthorized process to steal Teams authentication tokens.
This rule detects the installation and execution of the PsExec service (PSEXESVC) on Windows systems. It specifically looks for Event ID 7045 from the 'Service Control Manager' provider, which indicates a service installation event. The rule then checks if the installed service's name is 'PSEXESVC' or if its image path ends with '\PSEXESVC.exe'. This is a common indicator of PsExec being used for remote execution.
This rule detects the execution of `iptables` commands that configure TCP port redirection, specifically looking for the `--to-ports 42` or `--to-ports 43` arguments. This behavior is associated with the BPFDoor malware, which uses iptables to redirect incoming traffic on a specific port (e.g., SSH port 22) to a different, often higher, port where its shell is listening, effectively bypassing firewall rules for the attacker's host.
Detects suspicious shell commands commonly used in various exploit codes, including those associated with Apache Struts vulnerabilities and Metasploit framework activities. The rule looks for patterns indicative of downloading and executing scripts, setting up reverse shells, or modifying file permissions for persistence or privilege escalation.
Page 408 of 680