SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,731 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule identifies DNS queries made to domains associated with known cryptocurrency mining pools. It specifically looks for DNS queries where the 'query' field ends with any of the listed mining pool domains. The rule excludes queries with answers '127.0.0.1' or '0.0.0.0' and those marked as rejected, to reduce false positives. The primary goal is to detect potential resource hijacking through cryptomining on compromised systems.
This rule detects the execution of the PowerShell cmdlet 'Enable-PSRemoting'. This cmdlet configures the computer to receive PowerShell remote commands, which adversaries may use for lateral movement and remote execution. Detection relies on Script Block Logging being enabled to capture the cmdlet's execution.
This rule detects exploitation attempts against the Log4j RCE vulnerability, also known as Log4Shell (CVE-2021-44228). It looks for various JNDI (Java Naming and Directory Interface) lookup patterns, including LDAP, RMI, LDAPS, DNS, NIS, NDS, CORBA, and IIOP, as well as obfuscated forms of these patterns, which are commonly used to trigger the vulnerability. The rule specifically filters out known vulnerability scanning traffic from Nessus to reduce false positives.
This rule detects potential exploitation attempts of CVE-2021-42278, also known as "noPac" or "sAMAccountName spoofing". The exploit involves an attacker creating a computer object with known credentials, then clearing its ServicePrincipalName (SPN) attribute. This manipulation grants the attacker additional permissions on the object, allowing them to make further changes. The detection logic specifically looks for Kerberos Key Distribution Center (KDC) events (EventIDs 35, 36, 37, 38) which indicate anomalies in PAC (Privilege Attribute Certificate) or ticket requests, consistent with the post-exploitation phase of CVE-2021-42278 where forged tickets are used.
Detects child processes of 'dfsvc.exe' that are launched from the 'AppData\Local\Apps\2.0\' directory, which is indicative of a ClickOnce deployment execution. This rule aims to identify potentially malicious or unexpected ClickOnce application launches.
This rule detects PowerShell script blocks that utilize .NET's SslStream for establishing encrypted network connections. Specifically, it looks for the use of 'System.Net.Security.SslStream', 'Net.Security.RemoteCertificateValidationCallback', and '.AuthenticateAsClient' which are indicative of a client-side SSL/TLS connection being programmatically established, potentially for command and control (C2) purposes to evade detection.
Detects uncommon or suspicious child processes spawning from a Windows Subsystem for Linux (WSL) process. This behavior can indicate an attempt to evade parent/child relationship detections, or persistence attempts using cron within WSL. The rule specifically looks for common Windows LOLBINs (Living Off the Land Binaries) or processes launched from suspicious temporary or user-controlled directories, originating from wsl.exe or wslhost.exe.
Detects attempts to exploit the Grafana path traversal vulnerability (CVE-2021-43798) by looking for specific path traversal sequences combined with requests to known Grafana plugin directories that result in a successful HTTP status code (200).
Detects the execution of 'net.exe' or 'net1.exe' with command-line arguments commonly used for discovery activities related to accounts, groups, shares, and services. This rule aims to identify potential reconnaissance or privilege escalation attempts.
Detects when an application is removed from Google Workspace, which could indicate an attempt to disrupt services or remove security controls. This includes both direct application removal and removal from a whitelist.
Page 413 of 680