SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,706 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects various discovery commands commonly used on Cisco network devices. These commands are often used by adversaries to gather information about the network topology, device configuration, running processes, user sessions, and system details. The rule specifically looks for keywords associated with commands like 'dir' (file/directory listing), 'show arp' (ARP cache), 'show cdp' (Cisco Discovery Protocol neighbors), 'show clock' (system time), 'show ip interface' (IP interface configuration), 'show ip route' (routing table), 'show ip sockets' (network connections), 'show processes' (running processes), 'show ssh' (SSH sessions), 'show users' (logged-in users), and 'show version' (system information).
This rule detects log entries from Juniper BGP services indicating a missing MD5 digest. This condition can be a sign of a brute-force attack attempting to manipulate routing protocols, potentially leading to BGP hijacking or other network disruptions. BGP uses MD5 for authentication to ensure the integrity and authenticity of routing updates between peers. A missing MD5 digest suggests that an unauthenticated or malicious peer is attempting to establish a connection or send updates.
This rule detects the first-time observation of remote named pipe connections, excluding a predefined list of common and legitimate named pipes. This behavior is often indicative of lateral movement or remote execution using named pipes, which attackers commonly leverage to move within a network or execute code on remote systems. The rule specifically looks for connections to '\\*\IPC$', a common administrative share used for interprocess communication over a network. By filtering out known legitimate named pipes, the rule aims to reduce false positives and highlight potentially malicious activity.
Detects the default communication pattern used by the BabyShark C2 framework, specifically looking for the 'momyshark?key=' string within the URI of proxy requests. This pattern is indicative of BabyShark malware attempting to communicate with its command and control server.
Detects the use of rclone, a command-line program to manage files on cloud storage, by identifying its default user-agent string in proxy logs. This activity can indicate data exfiltration to cloud storage services.
Detects events generated by user-mode applications when they call the CveEventWrite API, indicating that a known vulnerability is potentially being exploited. Microsoft started using this log in January 2020, notably with CVE-2020-0601 (a Windows CryptoAPI vulnerability). However, the rule's description notes that this log has historically seen limited use for reporting CVEs.
This rule detects a suspicious crash of the Microsoft Malware Protection Engine (MsMpEng.exe), specifically when the mpengine.dll module is involved. Such crashes can indicate an attempt to exploit vulnerabilities in the antivirus software to bypass security defenses or disable the tool. The detection relies on Windows Error Reporting (EventID 1001) logs containing specific process and module names.
Detects potential installation or installation attempts of known malicious AppX packages by monitoring Windows AppXDeployment-Server Event IDs 400 and 401, specifically looking for a known malicious package full name.
Detects the creation of a new Background Intelligent Transfer Service (BITS) job by the `bitsadmin.exe` utility. Adversaries may use BITS jobs for various purposes, including downloading malicious files, maintaining persistence, or exfiltrating data, as BITS jobs can operate in the background and persist across reboots.
Detects the loading of an unsigned kernel module on a Windows system, which can indicate attempts to bypass security controls, establish persistence, or escalate privileges. This event is logged by Windows Code Integrity when it determines that a kernel module without a valid digital signature is being loaded.
Page 453 of 680