SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,723 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of the 'sqlite' or 'sqlite3' binary specifically when it is used to query sensitive data from Chromium-based browser profiles. The detection logic looks for command-line arguments that indicate access to common Chromium user data paths and specific database files containing login data, cookies, web data (credit cards, autofill), history, or bookmarks. This activity is highly indicative of an attempt to steal sensitive user information stored by web browsers.
Detects a suspicious RDP session redirect using the 'tscon.exe' utility with the '/dest:rdp-tcp#' command-line argument. This technique can be used by adversaries to hijack an existing RDP session, potentially leading to privilege escalation or lateral movement.
Detects exploitation attempts of CVE-2021-41773, a path traversal vulnerability in Apache HTTP Server 2.4.49. This flaw allows an attacker to map URLs to files outside the expected document root, potentially leading to information disclosure (e.g., source code of CGI scripts) or arbitrary file access if not properly protected. This vulnerability has been actively exploited in the wild and specifically affects Apache HTTP Server version 2.4.49.
Detects the creation of a file by WinRAR with a double extension and a space in the filename, specifically targeting the temporary directory. This pattern is indicative of an exploitation attempt related to CVE-2023-38331, a vulnerability in WinRAR that allows for arbitrary code execution through specially crafted archives.
Detects a network connection initiated by an "Msiexec.exe" process over port 80 or 443. Adversaries might abuse "msiexec.exe" to install and execute remotely hosted packages. This rule helps hunt for potentially anomalous or suspicious communications.
This rule detects when the master password for an AWS RDS database instance is changed. This activity could be a precursor to data exfiltration or an attempt to gain unauthorized access to the database. The rule specifically looks for the 'ModifyDBInstance' event from 'rds.amazonaws.com' where the 'masterUserPassword' in 'pendingModifiedValues' is present, indicating a password change.
This detection identifies the creation or update of a server instance within an Azure AD Hybrid Health AD FS service using Azure Activity logs. An adversary might perform this action to create a new AD Health ADFS service and a fake server instance to spoof AD FS signing logs, potentially bypassing the need to compromise an on-premises AD FS server. This can be achieved programmatically via HTTP requests to Azure.
Identifies when a service principal was removed in Azure. This action could indicate an attempt to remove legitimate service accounts to hinder detection or to clean up after malicious activity.
This rule detects changes to the device registration policy within Azure. Such modifications can be used by adversaries to evade defenses, escalate privileges, or enable unauthorized device registrations, potentially leading to broader access to the environment. The detection specifically looks for 'Set device registration policies' activity within the 'Policy' category of Azure Audit Logs.
Detects when a Google Cloud Storage bucket is modified or deleted. This includes operations such as deleting a bucket, inserting (creating) a bucket, or updating/patching a bucket's properties. Such activities can indicate unauthorized access, data manipulation, or attempts to disrupt services.
Page 424 of 680