SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,506 copies16 likes159,710 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potential suspicious execution of a process from a GUID-like folder name located in a suspicious temporary directory, a technique observed in IcedID attacks. This rule is designed to identify uncommon and potentially malicious activity stemming from such folders.
Detects errors in NodeJS applications related to process execution, specifically looking for the keyword 'node:child_process'. These errors, especially if triggered by user input, may indicate an attempted Remote Code Execution (RCE) vulnerability exploitation.
Detects when an AWS Elastic Container Service (ECS) Task Definition is created, described, or run, and its container definition includes a command that queries the AWS container credential endpoint. This activity can indicate an adversary attempting to establish persistence or escalate privileges by backdooring task definitions to extract credentials.
Identifies when an Azure Application Security Group is modified or deleted. This could indicate an attempt to alter network access controls, potentially to bypass security measures or disrupt services.
This rule detects when an end user grants consent to an application in Azure Active Directory (now Microsoft Entra ID). Specifically, it triggers when the 'ConsentContext.IsAdminConsent' field is 'false', indicating that the consent was given by a regular user rather than an administrator. This activity can be a precursor to adversaries stealing application access tokens by tricking users into authorizing malicious applications.
This rule detects an anomaly in the SAML token issuer, indicating a potential compromise of the SAML token. The detection is triggered when the 'riskEventType' is 'tokenIssuerAnomaly', suggesting that the claims within the token are unusual or align with known attacker patterns. This could signify an adversary forging web credentials, specifically SAML tokens, to gain unauthorized access.
Detects sign-in attempts with properties (e.g., device, location, browser) that are unusual or unfamiliar compared to a user's past sign-in history. This rule leverages Azure AD Identity Protection's risk detection capabilities to identify anomalous sign-ins.
Detects when a Google Cloud SQL database instance or its user accounts are created, deleted, or modified. This can indicate malicious activity such as data destruction, unauthorized access attempts, or attempts to disrupt services.
Detects when Microsoft Cloud App Security reports user activity originating from an IP address identified as an anonymous proxy. This indicates potential attempts to obscure the true source of network connections, which could be used for malicious purposes such as bypassing security controls or maintaining anonymity during an attack.
Detects attempts to collect data stored in the clipboard from users using the 'xclip' tool. This rule specifically looks for the execution of 'xclip' with arguments indicating clipboard selection and output. It is highly recommended for server environments due to the frequent legitimate use of clipboard utilities on user workstations.
Page 445 of 680