SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,727 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule identifies when an Azure VPN connection is either modified or deleted. This activity is captured through Azure Activity Logs, specifically looking for 'MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/WRITE' (modification) or 'MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/DELETE' (deletion) operations. Such actions can indicate an attempt to disrupt network connectivity or reconfigure access to cloud resources, potentially as part of an impact-oriented attack or unauthorized access.
Detects the addition of a new Federated Domain in Microsoft Exchange. This event can be indicative of credential abuse or the establishment of a backdoor via federated identities, potentially in the context of a Golden SAML attack.
Detects suspicious command executions on Linux systems, specifically focusing on modifications to file permissions (chmod 777, chmod u+s) and copying of shell binaries (/bin/ksh, /bin/sh). These actions are often associated with malware or hacking activities, such as privilege escalation or establishing persistence.
This rule detects the execution of the 'git clone' command on Linux systems when the command line arguments contain suspicious keywords. These keywords are indicative of activities related to exploits, vulnerabilities, remote code execution (RCE), or proof-of-concept (PoC) code for known vulnerabilities like ProxyShell, Log4Shell, and EternalBlue. The rule aims to identify attempts by adversaries to download malicious or exploit-related code from remote repositories.
This rule detects commands executed on Cisco network devices related to the export of private keys or the import/management of PKI certificates. Specifically, it looks for the commands 'crypto pki export', 'crypto pki import', and 'crypto pki trustpoint'. These actions can indicate an attempt to exfiltrate sensitive cryptographic material (private keys) or to establish new trusted certificates, which could be used for defense evasion or to facilitate man-in-the-middle attacks.
This rule detects NTLM brute force attempts by identifying specific workstation names commonly used by NTLM brute-forcing tools. It looks for Event ID 8004 in the Microsoft-Windows-NTLM/Operational log, specifically when the 'WorkstationName' field matches a list of known tool-related or generic Windows names.
Detects when a password-protected ZIP archive, likely received as an email attachment, is opened. The detection specifically looks for Event ID 5379 (Detailed File Share) in Windows Security logs, where the TargetName indicates a ZIP folder operation within the 'Temporary Internet Files\Content.Outlook' directory. This pattern is indicative of a user interacting with an email attachment that is a password-protected ZIP file.
This rule detects suspicious DNS queries that are characteristic of Cobalt Strike beacons. Specifically, it looks for DNS query names starting with 'aaa.stage.' or 'post.1', or containing '.stage.123456.'. These patterns are known indicators of Cobalt Strike's DNS communication for staging or command and control.
This rule detects a PowerShell downgrade attack where an adversary attempts to force PowerShell to use an older, less secure engine version (2.0) while the host system is configured for a newer version. This technique is often used to bypass security features like Script Block Logging which are present in newer PowerShell versions.
This rule detects the execution of the Tor client or Tor Browser, which are used to connect to the Tor anonymity network. Specifically, it looks for process creation events where the image path ends with '\tor.exe' or '\Tor Browser\Browser\firefox.exe'. This indicates an attempt to establish an anonymous connection, potentially for malicious command and control, data exfiltration, or to bypass network restrictions.
Page 423 of 680