SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,679 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the spawning of suspicious child processes by the Atlassian Confluence server, which may indicate successful exploitation of CVE-2021-26084. The rule specifically looks for the Confluence Java process spawning common command-line utilities and scripting interpreters often used in post-exploitation activities.
Detects successful exploitation attempts of the Microsoft Exchange Server vulnerability CVE-2021-28480. This vulnerability allows for remote code execution. The rule specifically looks for POST requests to '/owa/calendar/a' that result in an HTTP 503 status code, indicating a potential successful exploitation or a server error due to the exploit.
Detects exploitation attempts of the SonicWall SSL/VPN Jarrewrite vulnerability. The rule looks for requests to '/cgi-bin/jarrewrite.sh' combined with specific patterns in the 'cs-user-agent' header that indicate command injection attempts, such as ':;', '() {', or '/bin/bash -c'. This targets a known vulnerability allowing attackers to execute arbitrary commands.
Detects a command line pattern used by the Conti ransomware group to archive and stage the NTDS.dit database for exfiltration. The rule specifically looks for the execution of '7za.exe' (7-Zip archiver) with a command line that includes '\C$\temp\log.zip', indicating the creation of a zip archive in a temporary location, a common step before exfiltration.
This rule detects suspicious behaviors associated with the SOURGUM actor, as tracked by Microsoft. Specifically, it looks for the creation of processes with specific image paths related to 'Physmem.sys' or 'WimBootConfigurations.ini' within IME directories. Additionally, it identifies attempts to modify registry keys associated with Component Object Model (COM) objects, specifically InprocServer32 entries for CLSIDs {7c857801-7381-11cf-884d-00aa004b2e24} and {cf4cc405-e2c5-4ddd-b3ce-5e7582d8c9fa}, using the 'reg add' command.
This rule detects a specific HTTP GET request pattern associated with potential exploitation of CVE-2023-36884 by the RomCom threat group. The pattern involves a URI containing '/MSHTML_C7/' and a query parameter 'd' followed by an IPv4 address.
Detects potential beaconing activity to known malicious domains associated with the 3CXDesktopApp supply chain compromise. This rule specifically looks for connections through a proxy to a list of hardcoded domains identified as indicators of compromise (IOCs) during the 3CXDesktopApp incident.
Detects the execution of processes where the parent process is 'ws_tomcatservice.exe', excluding 'repadmin.exe'. This activity has been observed in campaigns attributed to Mint Sandstorm, specifically leveraging Log4J vulnerabilities.
This rule detects the use of PowerShell to mount Server Message Block (SMB) shares over the QUIC transport protocol. This activity, while legitimate, can be unusual in some enterprise environments and may indicate an adversary attempting to establish lateral movement or data transfer channels using a less common protocol.
Detects PowerShell scripts attempting to access the default Windows Mail App mailbox data. This activity could indicate an adversary trying to manipulate, exfiltrate, or delete stored emails. The detection specifically looks for the string '\Comms\Unistore\data' within PowerShell script blocks, which points to the location where the Windows Mail App stores its data.
Page 470 of 680