SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,706 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of 'rundll32.exe' where the loaded DLL does not have a '.dll' extension, often observed in Qakbot activity. The rule specifically looks for 'rundll32.exe' being spawned by common scripting or command-line interpreters and for the command line to contain paths frequently used by Qakbot for its payloads.
Detects a specific command line argument sequence used by the SNAKE malware during its installation phase, as detailed in a CISA report. The rule looks for a process creation event where the command line contains two specific arguments: the first is a 64-character hexadecimal string (assumed to be a SHA-256 hash), and the second is at least a 16-character hexadecimal string (assumed to be part of an AES initialization vector).
Detects Dllhost.EXE initiating an outbound network connection to a non-local IP address. Dllhost.exe is a legitimate Windows process that hosts DLL-based COM+ applications. While legitimate network communication from Dllhost.exe can occur, especially for applications it hosts, unexpected connections to external IP addresses (excluding known Microsoft ranges and local networks) can indicate malicious activity. Adversaries may abuse Dllhost.exe for proxy execution or to establish command and control.
Detects the execution of the `attrib.exe` utility with the `+s` flag, which is used to mark files as system files. This technique can be used by adversaries to hide malicious files from users and some security tools, contributing to defense evasion.
This rule detects when a user or entity makes changes to Amazon S3 bucket data management configurations. This includes modifications to logging, website hosting, encryption, lifecycle policies, replication configurations, and object restoration. Such changes could indicate an attempt to tamper with data integrity, availability, or exfiltration mechanisms within S3.
This rule identifies when an application is deleted in Azure. This could indicate an attempt by an adversary to remove traces of their activity, disrupt services, or impact the availability of applications.
Identifies when an Azure Network Firewall Policy is modified or deleted. This could indicate an attempt to bypass security controls or disrupt network segmentation.
This rule identifies when a new Azure Cloud Shell instance is created within the Azure portal. Cloud Shell provides a browser-based shell experience for managing Azure resources, and its creation could indicate administrative activity, or potentially, an attacker establishing a persistent command-line environment within a compromised Azure subscription.
This rule detects anomalous token characteristics, such as an unusual token lifetime or a token being used from an unfamiliar location. This indicates potential compromise or misuse of identity tokens.
Identifies user accounts that have been locked due to multiple failed sign-in attempts with incorrect credentials. This often indicates a brute-force attack or password guessing attempt against user accounts.
Page 451 of 680