SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,723 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects exploitation attempts targeting CVE-2021-27905, an arbitrary file read and SSRF vulnerability affecting Apache Solr versions up to and including 8.8.1. The rule looks for specific patterns in HTTP request URIs that are indicative of this vulnerability being exploited, such as requests containing '/solr/', '/debug/dump?', 'param=ContentStream', or 'command=fetchindex' with 'masterUrl='.
Detects the loading of a malicious 'version.dll' from the 'C:\Windows\ADFS\' directory, a technique used by the NOBELIUM threat group with their FoggyWeb backdoor to achieve DLL hijacking.
Detects a potential exploitation attempt of CVE-2023-25157, a SQL injection vulnerability in GeoServer. The rule looks for specific GET requests to '/geoserver/ows' containing 'CQL_FILTER=' along with known vulnerable functions or SQL injection keywords in the query string.
Detects the execution of a PowerShell script known as POWERHOLD, which has been attributed to the FIN7 threat group. The rule specifically looks for the presence of '$env:APPDATA', 'function MainPayload', '::WriteAllBytes', and 'wscript.exe' within the PowerShell script block text, indicating the execution of this specific malicious script.
Detects the execution of 'wget' to download a '.tar' file from an untrusted direct IP address, specifically when the '--no-check-certificate' flag is used. This behavior has been observed in attacks attributed to UNC4841 during their exploitation of Barracuda ESG zero-day vulnerabilities.
Detects exceptions in the Velocity template renderer, which likely indicates dynamic rendering of user-controlled input. This vulnerability, known as Server-Side Template Injection (SSTI), can lead to Remote Code Execution (RCE) if successfully exploited.
Identifies when the default Amazon Elastic Block Store (EBS) encryption is disabled in a specific AWS region. Disabling default encryption does not affect existing volumes but means newly created volumes will not be encrypted by default, potentially impacting data confidentiality and integrity.
This rule detects attempts to export an AWS EC2 instance, specifically when the 'CreateInstanceExportTask' event is logged in AWS CloudTrail. This action can be an indicator of an adversary attempting to exfiltrate data from a compromised EC2 instance by exporting it as a virtual machine image. The rule specifically looks for successful export task creations, filtering out events that contain error messages or codes, or indicate a 'Failure' in the response elements.
This rule detects when an AWS RDS database instance is restored from a snapshot and configured to be publicly accessible. This activity could indicate an attempt to exfiltrate data by making a copy of a database publicly available.
This rule detects attempts to shut down or reboot a Linux system using common commands like 'shutdown', 'reboot', 'halt', 'poweroff', or by using 'init' or 'telinit' with specific runlevel arguments (0 for halt/shutdown, 6 for reboot). Adversaries may use these methods to disrupt system availability or aid in the destruction of data.
Page 429 of 680