SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,730 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects attempts to delete history files, such as bash_history or zsh_history, on Linux systems. Adversaries often delete these files to remove traces of their activities and hinder forensic analysis. The rule specifically looks for process creation events where commands like 'rm', 'unlink', or 'shred' are used with command-line arguments indicating history files.
Detects potential token impersonation and theft on Windows systems. This rule specifically looks for successful logon events (EventID 4624) with a LogonType of 9 (NewCredentials), where the LogonProcessName is 'Advapi' and the AuthenticationPackageName is 'Negotiate', combined with an ImpersonationLevel indicating impersonation. This combination of events is indicative of an attempt to duplicate and impersonate an existing access token, often used for privilege escalation or defense evasion.
This rule detects RDP traffic communicating with the loopback address (127.0.0.1 or ::1) on either the source or destination port 3389, specifically looking for Windows Filtering Platform (WFP) events (EventID 5156). This behavior is indicative of RDP over a reverse SSH tunnel, where RDP traffic is redirected locally to bypass network restrictions or for covert communication. The rule explicitly filters out events originating from 'AppContainer Loopback' and known Thor processes to reduce false positives.
This rule detects suspicious command-line parameters commonly used by the Empire post-exploitation framework when launching PowerShell. Specifically, it looks for combinations of parameters such as '-NoP', '-sta', '-NonI', '-W Hidden', '-Enc', '-noP', '-w 1', '-enc', '-enc SQB', '-nop', '-exec bypass', and '-EncodedCommand'. These parameters are often used to execute encoded PowerShell scripts in a hidden or non-interactive manner, which is a common tactic for malicious PowerShell execution.
Detects suspicious PowerShell invocation command parameters indicative of obfuscated or malicious PowerShell execution. This includes attempts to execute base64 encoded commands, use of `IEX` (Invoke-Expression) with hidden windows and `New-Object`, execution of encoded commands, and use of `WebClient` to download and execute content.
Detects the use of rundll32.exe to launch an NSIS (Nullsoft Scriptable Install System) module, specifically looking for 'nsis_uns' and 'PrintUIEntry' in the command line. This behavior has been observed in the Rhadamanthys infostealer, where rundll32.exe is used to execute its main stealer capability.
Detects when Google Cloud Storage buckets are enumerated. This activity involves listing storage buckets or their channels, which can be an indicator of reconnaissance by an attacker attempting to understand the environment's data storage landscape.
This rule identifies when a VPN Tunnel is modified or deleted within Google Cloud Platform. Adversaries may modify or delete VPN tunnels to disrupt network connectivity, reroute traffic, or hinder defensive efforts, impacting the availability or integrity of services.
This rule detects command-line operations that target common shell history files on Linux systems. Adversaries often manipulate or delete these files to remove traces of their activities or to extract sensitive information like credentials that might have been typed into the command line. The rule specifically looks for execution events (`EXECVE`) that involve files such as `.bash_history`, `.zsh_history`, `.zhistory`, `.history`, `.sh_history`, and `fish_history`.
This rule detects attempts to enable BPF kprobes tracing on a Linux system. This is achieved by writing '1' to specific files within the '/sys/kernel/debug/tracing/events/kprobes/' directory, specifically targeting '/myprobe/enable' or '/myretprobe/enable'. This activity can be indicative of an attacker attempting to gain deep system visibility or to implement advanced evasion techniques.
Page 414 of 680