SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,723 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potential suspicious child processes of "jamf". This could indicate the abuse of Jamf as a C2 server, as observed with the Typhon MythicAgent. Specifically, the rule looks for '/bash' or '/sh' being spawned as child processes of the 'jamf' executable.
Detects the use of common network scanning tools like netcat, nmap, and telnet on macOS systems. The rule specifically looks for process creation events where the image path ends with '/nc', '/netcat', '/nmap', or '/telnet'. It includes a filter to exclude 'netcat' commands containing 'l' (often used for legitimate listening modes), aiming to reduce false positives related to simple network listening.
Detects attempts to use the built-in 'screencapture' utility to collect screenshots on macOS systems. This utility can be used by adversaries to gather visual information from a compromised system.
Detects attempts to download executable files via WebDAV. This activity has been observed in campaigns attributed to APT29, where adversaries leverage WebDAV to transfer malicious tools into a compromised environment.
Detects the download of potentially malicious file types (executables, scripts, documents, archives, etc.) from domains using suspicious or commonly abused Top-Level Domains (TLDs). This rule aims to identify initial access attempts often associated with phishing or drive-by download campaigns.
This rule detects the use of Background Intelligent Transfer Service (BITS) to connect to IP addresses directly, rather than fully qualified domain names (FQDNs). This behavior can be indicative of malicious activity, as adversaries often use BITS for command and control or data transfer, and connecting to IP addresses can be a way to bypass DNS-based security controls or to obscure the true destination.
This rule detects when an application or file is prevented from running by AppLocker. It specifically looks for AppLocker event IDs 8004, 8007, 8022, and 8025, which indicate that an executable, script, or other file type was blocked from execution based on configured AppLocker policies. This is a critical control for preventing unauthorized software execution, especially in environments where users might attempt to run unapproved applications or scripts.
Detects when an unsigned image (DLL, EXE, etc.) is loaded into the system, as reported by Windows Code Integrity. This can indicate attempts to bypass security controls, execute malicious code, or privilege escalation.
Detects when Code Integrity identifies and blocks the loading of an image (DLL, EXE, etc.) that has a revoked digital certificate. This indicates an attempt to load untrusted or malicious code, potentially bypassing security controls. Event ID 3035 specifically notes cases where the image is allowed to load due to a kernel mode debugger being attached, which is a highly suspicious activity.
Detects when a kernel module that does not meet WHQL (Windows Hardware Quality Labs) signing requirements is loaded into the system. This can indicate the presence of unsigned or improperly signed drivers, which might be malicious or unstable. The rule specifically looks for Code Integrity Event IDs 3082 and 3083, which signify that such a module was loaded, even if allowed due to auditing policy.
Page 433 of 680