SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,729 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify successful exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.
Detects the creation of named pipes that match specific patterns known to be used by Cobalt Strike's Malleable C2 profiles. These patterns are often indicative of Cobalt Strike beacon activity on a system.
Detects the creation of named pipes that have been observed in use by known APT groups or malware. This rule specifically looks for a predefined list of pipe names associated with various malicious activities, including those used by Project Sauron, SolarWinds SUNBURST, LiquidSnake, Turla HyperStack, Sofacy group malware, Hidden Cobra Hoplight, Pacifier, Snatch Ransomware, Covenant, Qbot, Uroburos Malware, PoshC2, Wild Neutron, Cloud Hopper (RedLeaves), Equation Group malware, Cobra Trojan, Crackmapexec, and Emissary Panda (Hyperbro).
This rule detects the loading of the 'Microsoft.ActiveDirectory.Management.dll' DLL via PowerShell's 'Import-Module' or its alias 'ipmo'. This DLL is part of the Active Directory module for PowerShell and is frequently used by attackers to perform Active Directory enumeration, especially in environments where RSAT tools are not installed or administrative privileges are not readily available. The detection focuses on the command line payload containing both the module import command and the specific DLL name.
Detects the execution of Netcat (nc.exe, ncat.exe, netcat.exe) with suspicious command-line arguments often associated with establishing listener modes, reverse shells, or proxy connections. Netcat is a versatile networking utility that can be used by adversaries for command and control (C2) communication, data exfiltration, or creating backdoors, often leveraging non-application layer protocols.
Detects potentially suspicious SQL queries executed via sqlcmd.exe targeting Veeam backup databases. The rule specifically looks for commands that attempt to query sensitive tables such as BackupRepositories, Backups, Credentials, HostCreds, SmbFileShares, Ssh_creds, and VSphereInfo, which could indicate an attempt to steal information from the Veeam backup infrastructure.
Detects a network connection initiated from a process located in the "C:\Users\Public" folder. Attackers are known to drop their malicious payloads and malware in this directory as it's writable by everyone. This rule helps hunt for potential suspicious or uncommon activity in the environment.
This rule identifies when a device registered in Azure Active Directory (now Microsoft Entra ID) transitions to a state where it is no longer considered managed or compliant. This could indicate a change in device policy, a device being unenrolled, or a security posture degradation.
This rule identifies sign-in attempts from geographically distant locations within a short timeframe, which is indicative of an "impossible travel" scenario. It also considers if one of these locations is atypical for the user based on their past behavior. This pattern often suggests that an attacker has compromised user credentials and is attempting to access the account from a new, unusual location, potentially using a VPN or proxy service to mask their true origin.
Detects potential container discovery by monitoring for common Linux utilities (awk, cat, grep, head, less, more, nl, tail) being used to read specific files within the '/proc' virtual filesystem. Specifically, it looks for access to '/proc/2/' (which would typically be kthreadd outside a container) or '/proc/cgroup' and '/proc/sched' which can reveal containerized environments due to differences in their content or PID mappings.
Page 417 of 680