SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,730 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when a stored procedure in MSSQL is configured for automatic execution upon SQL Server startup using `sp_procoption`. This can be used by adversaries to establish persistence.
This rule detects when an external disk drive or a USB mass storage device is recognized by the system. It specifically looks for Windows Security Event ID 6416, which indicates that a new external device was recognized, and further filters for devices classified as 'DiskDrive' or with the description 'USB Mass Storage Device'. This can be an indicator of initial access, data exfiltration, or the introduction of malicious software via removable media.
This rule detects the creation of an Alternate Data Stream (ADS) that contains an executable file. It specifically looks for the presence of a non-empty Import Hash (Imphash) within the created stream, indicating executable content. The rule filters out streams with a null Imphash, which typically correspond to non-executable data.
This rule detects the execution of well-known DNS exfiltration and tunneling tools, specifically 'iodine.exe' and 'dnscat2'. These tools are commonly used by adversaries to establish covert communication channels over DNS, allowing for data exfiltration and command and control activities that might bypass traditional network defenses.
Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule. This can be used by adversaries for lateral movement, defense evasion, or command and control.
Detects exploits that leverage CVE-2017-11882 by monitoring for the execution of EQNEDT32.EXE as a parent process, which is indicative of the vulnerability being exploited to launch further malicious processes like mshta.exe.
This rule detects when a USB device is plugged in or unplugged by monitoring specific event IDs from the Microsoft-Windows-DriverFrameworks-UserMode/Operational event log. Event ID 2003 indicates driver loading, while Event IDs 2100 and 2102 relate to Plug and Play (PnP) or power management events, which are typically generated when a USB device is connected or disconnected.
Detects the usage of specific LDAP attributes ('primaryInternationalISDNNumber', 'otherFacsimileTelephoneNumber', 'primaryTelexNumber') that are known to be used by the LDAPFragger tool for data exchange via LDAP. These attributes are generally not commonly used in enterprise environments, making their appearance suspicious and indicative of potential Command and Control activity.
This rule detects when a file's creation timestamp is changed to a different year than its previous creation timestamp. This technique, known as timestomping, can be used by attackers to make malicious files appear legitimate or to evade detection by blending them with existing system files. The rule specifically looks for changes where the year component of `PreviousCreationUtcTime` differs from `CreationUtcTime`. It includes filters to reduce false positives from common system processes like `ProvTool.exe`, `usocoreworker.exe`, `SystemSettings.exe`, and `TiWorker.exe` when handling temporary files or cabinet files.
Detects suspicious child processes spawned by the Veeam SQL Server database process. This activity could indicate a successful Remote Code Execution (RCE) or SQL Injection attack against the Veeam database, where an attacker has managed to execute system commands or scripts.
Page 411 of 680