SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,720 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when the built-in 'openssl' utility is used on macOS to decode and decrypt a payload, specifically when the command line arguments indicate base64 encoding and decryption, and the input file is located within a '/Volumes/' path. This behavior is often observed in adware or malware families like Bundlore and Shlayer, which use disk images (DMGs) to deliver encoded and encrypted payloads to evade detection and trick users into execution.
Detects the creation of scheduled tasks using the 'crontab' utility on macOS, specifically when the command line indicates the crontab job is being uploaded from the '/tmp/' directory. This behavior can be indicative of an adversary establishing persistence or executing malicious code.
This rule detects attempts to masquerade as legitimate files on macOS by appending a space to the end of a filename. This technique can trick users and the operating system into executing a malicious file, despite a seemingly benign file extension. The rule specifically looks for process creation events where the command line or the image path ends with a space character.
Detects the execution traces of the WizardUpdate malware, a macOS trojan that attempts to infiltrate macOS machines to steal data and is associated with other types of malicious payloads. The rule specifically looks for shell commands executing `curl` with a specific pattern (`=$(curl ` and `eval`) or `curl` commands containing `_intermediate_agent_`.
Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE
Detects the use of the spoolss named pipe over SMB. This can be used to trigger NTLM authentication from machines with the spooler service enabled, often as part of NTLM relay attacks or credential harvesting.
This rule detects when an Nginx worker process crashes and generates a core dump, indicated by the log message 'exited on signal 6 (core dumped)'. This event can signify a serious underlying problem with the Nginx configuration, a plugin, or potentially an exploitation attempt targeting the Nginx server. Core dumps contain the memory state of the process at the time of the crash, which can be valuable for debugging but also sensitive if exposed.
This rule detects direct access to raw content hosted on various paste services. Adversaries often use these services to host malicious code (e.g., encrypted or encoded payloads) that is downloaded in subsequent stages of an attack, leveraging the services for command and control or defense evasion.
Detects HTTP requests with an empty user agent string in proxy logs. This can indicate an uncommon or potentially malicious request method, as legitimate browsers and many applications typically send a user agent. PowerShell's `(New-Object Net.WebClient).DownloadString` is one example of a tool that might generate such a request.
This rule detects suspicious DNS queries that are characteristic of Cobalt Strike beaconing activity. Specifically, it looks for DNS queries with names starting with 'aaa.stage.' or 'post.1', or containing '.stage.123456.'. These patterns are known indicators of Cobalt Strike's DNS communication for staging or command and control.
Page 437 of 680