SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,717 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects attempts to inject Cross-Site Scripting (XSS) payloads via GET requests in web access logs. It specifically looks for common XSS strings and encoded variations within the request URL, such as '<script>', '<iframe>', '<svg>', 'document.cookie', 'document.domain', 'onerror=', 'onresize=', 'onload=', 'onmouseover=', '${alert', 'javascript:alert', and their URL-encoded forms. The rule filters out requests that result in a 404 HTTP status code to reduce false positives.
Detects when an attacker attempts to establish persistence or escalate privileges on an MSSQL server by adding a new or existing account to the 'sysadmin' fixed server role. This action grants the account full administrative control over the SQL Server instance.
Detects when a diagcab package is loaded from a remote path. This behavior has been observed in the context of the DogWalk vulnerability, where attackers could leverage this to achieve arbitrary code execution.
Detects attempts to export an Exchange mailbox to an unusual file path, specifically to a network share or a file with an .aspx extension, which could indicate an adversary attempting to place a webshell. It also detects the assignment of the 'Mailbox Import Export' role to a user, a prerequisite for performing mailbox exports.
Detects scenarios where the OpenSSH server starts listening on an SSH socket, which could indicate an attacker enabling the service for remote access or persistence. This rule specifically looks for EventID 4 from the OpenSSH service with the process name 'sshd' and a payload starting with 'Server listening on '.
This rule detects when a Windows Event Log has been cleared. This activity is often performed by attackers to remove traces of their presence on a compromised system. The rule specifically looks for Event ID 517 from the 'Security' provider or Event ID 1102 from the 'Microsoft-Windows-Eventlog' provider, both of which indicate that an event log has been cleared. This can be caused by commands like 'wevtutil cl' or other methods of log manipulation.
Detects attempts to back up the Data Protection Application Programming Interface (DPAPI) Domain Master Key. This event is generated at the source machine, not the Domain Controller, indicating a potential attempt to gain access to encrypted data.
Detects when the password policy is enumerated on a Windows system. This activity is logged as Event ID 4661, specifically looking for access rights related to 'ReadPasswordParameters' on objects within the 'Security Account Manager'. This can indicate an adversary attempting to gather information about password requirements to aid in further attacks like password guessing or brute-forcing.
This rule detects the Hybrid Connection Manager service running on a Windows endpoint. It specifically looks for Event IDs 40300, 40301, or 40302 in conjunction with keywords like 'HybridConnection', 'sb://', 'servicebus.windows.net', or 'HybridConnectionManage'. This service is used to connect on-premises resources to Azure services, and its activity could indicate legitimate cloud integration or potentially malicious use for persistence or data exfiltration.
This rule detects the exploitation of a specific NTFS vulnerability that causes file system corruption. The detection is based on Windows System event logs, specifically Event ID 55 from the 'Ntfs' provider, indicating a corrupted file record with the file name being a single backslash.
Page 442 of 680