SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,717 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of script files with extensions such as .js, .jse, .vba, .vbe, .vbs, and .wsf by the Windows Script Host executables, Wscript.exe or Cscript.exe. This activity is often associated with malicious script execution, including those delivered via phishing or used in post-exploitation phases.
Detects changes to the EC2 instance startup script (User Data). The shell script will be executed as root/SYSTEM every time the specific instances are booted up, allowing for persistence and execution of arbitrary commands.
This rule detects attempts to modify or delete findings and insights within AWS SecurityHub. Adversaries may do this to evade detection by removing or altering security alerts generated by SecurityHub, thereby hindering defensive mechanisms and obscuring their activities. The rule specifically looks for 'BatchUpdateFindings', 'DeleteInsight', 'UpdateFindings', and 'UpdateInsight' events originating from 'securityhub.amazonaws.com'.
This rule identifies when a device or device configuration is modified or deleted within Azure. This activity is logged in Azure Activity Logs and can indicate administrative changes, potential misconfigurations, or malicious activity aimed at impacting the availability or integrity of cloud resources.
This rule detects the use of the Resource Owner Password Credentials (ROPC) authentication flow. ROPC is generally discouraged because it requires applications to directly handle user credentials, increasing the risk of credential compromise. While it can be used for automated testing or legacy applications, its presence in other contexts may indicate a security weakness or an attempt to bypass more secure authentication mechanisms.
Detects when Microsoft Cloud App Security reports that a user has uploaded files to the cloud that are potentially infected with ransomware. This indicates a possible ransomware attack attempting to encrypt or exfiltrate data via cloud storage.
Detects suspicious command-line activity on Linux systems where base64 encoded input is piped directly into a shell for execution. This technique is often used by adversaries for defense evasion and to obfuscate malicious commands.
Detects attempts to collect data stored in the clipboard from users using the 'xclip' tool. This rule is particularly relevant for servers, where legitimate usage of clipboard utilities is less common than on user workstations. The rule specifically looks for the execution of 'xclip' with parameters '-sel', 'clip', and '-o', which are used to output the contents of the clipboard.
This rule detects command-line patterns indicative of reconnaissance activities on Linux systems, specifically searching for '.htpasswd' files which often contain credentials, and files with SUID/SGID permissions ('-perm -4000') which can be exploited for privilege escalation. These commands are commonly used by attackers to gather information about the system's configuration and potential credential storage locations.
Detects enumeration of local system groups on macOS using common command-line utilities such as `dscacheutil`, `cat`, and `dscl`. This activity is often performed by adversaries during the discovery phase to identify privileged accounts or groups for lateral movement or privilege escalation.
Page 436 of 680