SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,687 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects an attempt to dump credentials from the VeeamBackup database using sqlcmd.exe by querying the 'VeeamBackup.dbo.Credentials' table. This activity is indicative of an attacker trying to extract sensitive information, potentially for lateral movement or further compromise.
Detects the execution of copy commands or utilities (robocopy, xcopy, cmd copy, PowerShell Copy-Item/Move-Item) targeting or originating from Windows Admin shares (e.g., C$) or the Sysvol folder. This activity can indicate lateral movement, data collection, or exfiltration by an adversary.
This rule detects the potential use of an SSH utility to establish Remote Desktop Protocol (RDP) over a reverse SSH Tunnel. Attackers commonly use this technique to enable routing of network packets that would otherwise not reach their intended destination, bypassing network segmentation or firewalls. The detection logic looks for command-line arguments containing the RDP port ':3389' in conjunction with common SSH tunneling switches such as '-L', '-P', '-R', '-pw', or '-ssh'.
Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key. This key is created when a Sysinternals tool is run for the first time and the End User License Agreement (EULA) is accepted.
Detects changes to the "AutodialDLL" registry key, which can be used as a persistence method to load custom DLLs via the "ws2_32" library. This technique allows an attacker to execute malicious code every time a process loads the Winsock2 library.
Detects the execution of a renamed SysInternals tool, specifically 'ps.exe', with command-line arguments '-accepteula' and '-s cmd /c netstat'. This specific combination has been observed in attacks attributed to the Dragonfly APT group and is documented in the US-CERT TA17-293A alert.
Detects potential QakBot activity by identifying specific process execution patterns previously associated with the malware. This includes scenarios where WinRAR executes wscript.exe, command lines containing 'ping.exe -n 6 127.0.0.1 & type', or regsvr32.exe executing from 'C:\ProgramData' with a '.tmp' file.
This rule detects registry modifications associated with the Ke3chang/TidePool malware families. Specifically, it looks for command-line arguments used to modify the 'Check_Associations', 'DisableFirstRunCustomize', and 'IEHarden' registry keys. These modifications are known to be unique to these malware families and were observed in campaigns in 2019 and 2020.
Detects exploitation attempts against the Oracle WebLogic server vulnerability CVE-2021-2109. The rule specifically looks for GET requests containing 'com.bea.console.handles.JndiBindingHandle', 'ldap://', and 'AdminServer' in the URI query, which are indicators of an attempted JNDI injection via LDAP.
Detects exploitation attempts targeting the VMware View Planner vulnerability, CVE-2021-21978. This vulnerability allows for arbitrary file upload due to an unrestricted file upload flaw in the 'upload' function, specifically within the 'wsgi_log_upload.py' script. Attackers can leverage this to upload malicious files, potentially leading to remote code execution.
Page 469 of 680