SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,700 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of AppleScript or JavaScript for Automation (JXA) scripts on macOS systems. It specifically looks for the 'osascript' utility being used with command-line arguments that indicate direct script execution ('-e') or the execution of script files with '.scpt' (AppleScript) or '.js' (JavaScript/JXA) extensions. This activity can be indicative of an adversary using scripting interpreters for execution.
Detects the execution of the 'jamf' binary with specific commands that could be used by attackers for privilege escalation, bypassing security controls, or modifying system configurations. This includes creating user accounts, managing the JAMF framework, removing MDM profiles, resetting passwords, and setting computer names.
This rule detects the execution of system commands commonly used to shut down, reboot, or halt a macOS system. Adversaries may use these commands to disrupt system availability or aid in the destruction of systems.
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed. This change is often a precursor to adversaries executing operating system commands via SQL Server.
This rule detects the creation or modification of AppX packages in suspicious file system locations. Adversaries may place malicious AppX packages in common temporary or public directories to evade detection or achieve persistence. The rule specifically looks for Event ID 854 from the 'appxdeployment-server' service, indicating an AppX package being added to the processing pipeline, and checks if the package's path contains known suspicious locations such as public user directories, temporary folders, or desktop/downloads folders.
This rule detects when an application acquires a certificate private key. This event (EventID 70 in the CAPI2 Operational log) indicates that a private key associated with a certificate has been accessed or exported. This activity can be indicative of an adversary attempting to steal or gain access to authentication certificates for various malicious purposes, such as impersonation or persistence.
Detects a BITS transfer job downloading file(s) from a direct IP address. This technique is often used by adversaries for defense evasion and persistence, as BITS jobs can operate in the background, bypass some firewall rules, and persist across reboots.
Detects DNS queries to "ufile.io", which has been observed as a method for data exfiltration by malware and threat actors. This rule specifically looks for Event ID 3008 in the Microsoft-Windows-DNS Client Events/Operational log where the QueryName contains 'ufile.io'.
Detects the creation of a local hidden user account on Windows systems. Hidden accounts are often indicated by a dollar sign ($) at the end of the username and can be used by adversaries for persistence.
Page 458 of 680