SigmaHQ Detections
@sigmaHQ12 followers122,434 downloads2,547 copies16 likes159,875 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the exploitation of the Wazuh RCE vulnerability described in CVE-2021-26814. This rule specifically looks for a URI query containing '/manager/files?path=etc/lists/../../../../..' which is indicative of a path traversal attempt to access sensitive files outside the intended directory.
Detects potential command and control (C2) beaconing activity to domains identified as being used in the 'Operation Triangulation' campaign, which targeted iOS devices with 0-day exploits. This rule specifically looks for connections to a list of known malicious domains via proxy logs.
Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account.
Identifies when a network security configuration in Azure is modified or deleted. This could indicate an adversary attempting to bypass security controls, establish persistence, or impact the availability of resources.
Detects the execution of the Bash shell with the '-i' flag, which indicates an interactive shell. This is commonly used in reverse shells or other scenarios where an attacker wants to interact with the compromised system.
This rule detects attempts to discover if a process is running inside a Docker container by listing or reading the '.dockerenv' file. Attackers often perform container discovery to understand their environment and plan subsequent actions. The rule specifically looks for common Linux utilities like 'cat', 'ls', 'find', 'dir', 'stat', 'test', or 'grep' being executed with '.dockerenv' in their command line arguments.
Detects Border Gateway Protocol (BGP) authentication failures, which can indicate attempts to brute force BGP peer authentication. Such attacks aim to manipulate routing information, potentially leading to traffic redirection or denial of service.
Detects an attempt to install an AppX package that fails due to a signing requirement error (0x80073cff). This error indicates that the package is not properly signed, which can be a characteristic of suspicious or malicious applications attempting to bypass security measures.
Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store. This activity can be indicative of an adversary attempting to steal authentication certificates for various malicious purposes, including lateral movement, persistence, or privilege escalation.
Detects service ticket requests using the weak RC4 encryption type (0x17) for Kerberos, which is often abused in Kerberoasting attacks. The rule specifically looks for Event ID 4769 (A Kerberos service ticket was granted) where the TicketOptions indicate a forwardable and renewable ticket, and the TicketEncryptionType is RC4. It attempts to reduce false positives by excluding service names ending with a dollar sign, which are typically machine accounts.
Page 427 of 680