SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,687 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of the 'split' command, which is commonly used to break large files into smaller, more manageable pieces. Adversaries may use this technique to circumvent data transfer size limits during exfiltration or to prepare data for transfer through channels with size restrictions. The detection focuses on the command line execution of the 'split' utility.
This rule detects commands commonly used on Cisco network devices to collect configuration data, which may contain sensitive information such as credentials. The commands include 'show running-config' to display the current operational configuration, 'show startup-config' to display the configuration loaded at boot, and 'show archive config' which can show archived configurations. An adversary might use these commands to gather information about the network, discover credentials, or understand the device's security posture.
Detects Label Distribution Protocol (LDP) authentication failures on Cisco devices, which could indicate an adversary attempting to brute force LDP authentication to manipulate MPLS labels. This could be part of an effort to disrupt network traffic or gain unauthorized access.
Detects downloads of potentially malicious file types (executables, scripts, documents, archives) from domains that are not common Top-Level Domains (TLDs). This rule aims to identify suspicious file transfers that bypass typical, trusted sources.
This rule detects suspicious Windows file path strings (e.g., 'C:/Users', 'C:/Windows', 'C:/Program Files') within the URI query component of web requests. The presence of such strings in a URI could indicate an attempt to exfiltrate data from a Windows system or communicate with a webshell that is attempting to access local files or directories. The rule looks for both standard and URL-encoded variations of these paths.
Detects Windows error reporting events where the Local Security Authority Subsystem Service (LSASS) process crashes with a specific exception code. This behavior can indicate an intentional crash, often associated with techniques like Lsass-Shtinkering, to facilitate credential dumping from LSASS memory.
This rule detects the installation of Microsoft Installer (MSI) packages from suspicious file system locations. It specifically looks for MsiInstaller events (Event IDs 1040 and 1042) where the installation source path contains known suspicious directories such as Windows temporary folders, remote shares (indicated by '\\'), Desktop, PerfLogs, or Public user folders. The rule includes filters to reduce false positives from legitimate applications like WinGet or specific update health tools.
Detects when the deployment of an AppX package is blocked by an AppLocker policy. This indicates an attempt to install or run an unauthorized application package, which could be a defense evasion attempt or an attempt to introduce malicious software.
Detects the loading of a kernel driver that has been revoked by Code Integrity. This indicates an attempt to load a driver that is no longer trusted, potentially for malicious purposes or due to a known vulnerability. Event ID 3021 signifies a revoked driver load, while 3022 indicates a revoked driver load allowed due to a kernel mode debugger being attached.
This rule detects attempts to load an image (e.g., a DLL or executable) that has been blocked by Windows Code Integrity because its signing certificate has been revoked. This indicates that a potentially malicious or untrusted module is trying to execute on the system, and the operating system's integrity checks are preventing it.
Page 466 of 680