SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,507 copies16 likes159,711 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of the '--cpu-priority' command-line parameter, which is commonly associated with cryptocurrency miners, particularly XMRig, to prioritize CPU usage for mining operations. This can indicate the presence of coin mining malware on a system.
Detects the stopping of system firewall services (firewalld, iptables, ufw) on Linux systems. Adversaries may disable firewalls to bypass network controls, facilitate C2 communications, lateral movement, or data exfiltration.
This rule detects various commands and file accesses indicative of system information discovery on Linux systems using auditd logs. It looks for access to common system release files like /etc/lsb-release, /etc/redhat-release, and /etc/issue. Additionally, it identifies the execution of commands such as 'uname', 'uptime', 'lsmod', 'hostname', and 'env'. The rule also flags 'grep' commands searching for virtualization indicators ('vbox', 'vm', 'xen', 'virtio', 'hv') and 'kmod list' commands, which are often used to enumerate loaded kernel modules.
This rule detects the execution of the `bpftrace` utility with the `--unsafe` option. The `bpftrace` tool is a high-level tracing language for Linux, and the `--unsafe` option allows it to perform operations that could potentially compromise system stability or security, such as writing to arbitrary memory locations or executing arbitrary code in the kernel. This usage could indicate an attempt to perform advanced system manipulation, potentially for privilege escalation, stealthy execution, or system compromise.
This rule detects command-line parameters and strings commonly associated with cryptocurrency mining software, specifically targeting Monero miners like XMRig. It looks for specific arguments such as CPU priority settings, donation levels, pool addresses (e.g., 'pool.', 'stratum+tcp://', 'stratum+udp://'), algorithm specifications ('--algo=rx/0'), and base64 encoded versions of these strings. It also includes a specific command for loading the 'msr' kernel module, which can be used by miners to optimize performance.
Detects the spawning of suspicious child processes by an Atlassian Confluence server, specifically looking for shell interpreters (sh, bash, dash, ksh, zsh, csh, fish), curl, wget, or python being executed as child processes of the Confluence Java process. This behavior is indicative of successful exploitation of CVE-2022-26134, a critical remote code execution vulnerability in Atlassian Confluence. The rule focuses on the post-exploitation phase where an attacker would execute commands on the compromised server.
Detects the execution of the 'ls -id /' command, which is a common technique used by adversaries to determine if they are running inside a container. The number of inodes for the root directory is typically much higher inside a containerized environment compared to a bare-metal system.
Detects additions or modifications to Emond Launch Daemon rule files or client directories, which adversaries may use to gain persistence and elevate privileges on macOS systems. This rule specifically looks for new or changed files in '/etc/emond.d/rules/' (plist files) or '/private/var/db/emondClients/'.
Detects enumeration of local system accounts on macOS using various command-line utilities such as 'dscl', 'dscacheutil', 'cat /etc/passwd', 'id', and 'lsof -u'. This activity is indicative of an adversary attempting to discover existing user accounts on a compromised system.
Detects the execution of system utilities commonly used on macOS to discover network connections and logged-in users. These utilities include 'who', 'w', 'last', 'lsof', and 'netstat'. Adversaries may use these commands during the discovery phase to understand the network environment and identify potential targets or communication paths.
Page 452 of 680