SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,712 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects potential ReGeorg webshell activity by looking for specific query parameters in web server logs. It focuses on requests that contain 'cmd=read', 'connect&target', 'cmd=connect', 'cmd=disconnect', or 'cmd=forward' in the URI query string, combined with a null referrer and null user agent, and using the POST method. This combination of indicators is highly suspicious for webshell communication.
This rule detects a suspicious crash of the Microsoft Malware Protection Engine (MsMpEng.exe) as indicated by an Application Error event (EventID 1000) containing both 'MsMpEng.exe' and 'mpengine.dll' in the event data. Such crashes could be indicative of an attempt to bypass or disable antivirus defenses, potentially through exploitation of vulnerabilities in the engine.
Detects DNS queries for subdomains related to the MEGA cloud storage service. This activity can indicate data exfiltration to cloud storage, potentially using tools like Rclone.
This rule detects the removal of an exported Exchange mailbox using the 'Remove-MailboxExportRequest' cmdlet with the '-Confirm "False"' parameter. This activity could indicate an adversary attempting to cover their tracks after exfiltrating data, potentially following an exploit like ProxyShell.
This rule detects failed attempts to install an Exchange Transport Agent. It specifically looks for Event ID 6 in the MSExchange Management logs and the string 'Install-TransportAgent' within the event data. This could indicate an adversary attempting to establish persistence on an Exchange server.
Detects the installation of suspicious applications by monitoring the Windows Shell-Core event log for EventID 28115, which indicates a shortcut being added to the app resolver cache. The rule specifically looks for known suspicious application names like Zenmap, AnyDesk, Wireshark, and OpenVPN in the 'Name' or 'AppID' fields.
Detects the installation or execution of services associated with known hack tools or UAC bypass techniques. The rule specifically looks for Windows Service Control Manager events (7045 for service installation, 7036 for service state changes) in conjunction with service names or image paths that are indicative of tools like cachedump, gsecdump, pwdump, PsExec, or UAC bypass mechanisms.
This rule detects events indicating issues with Windows Defender Real-Time Protection features. Specifically, it triggers when Real-Time Protection encounters an error and fails (EventID 3002) or when a Real-Time Protection feature restarts (EventID 3007). It filters out common false positives related to Network Inspection System errors due to missing updates or unknown antimalware security intelligence issues.
Detects the download of suspicious file types from URLs containing direct IP addresses. This rule specifically looks for the creation of Zone.Identifier alternate data streams (ADS) for common executable or script file extensions, indicating a file downloaded from the internet, combined with a URL that uses an IP address instead of a domain name. This behavior can be indicative of malware delivery or staging.
This rule detects the creation of a file named 'dumpert.dmp', which is the default output file used by the Outflank Dumpert tool. Dumpert is a process dumper specifically designed to extract memory from the Local Security Authority Subsystem Service (LSASS) process, which often contains sensitive credential material.
Page 447 of 680