SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,679 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects command line usage of "findstr.exe" to search for keywords related to "passwords" in various languages. This activity can indicate an adversary attempting to locate credentials stored in files on a compromised system.
This rule detects the execution of the 'tasklist' command, which adversaries may use to gather information about running processes on a system. This information can help them understand the system's environment and identify potential targets or further actions.
Detects the creation, deletion, or update of AWS Glue Development Endpoints. This activity can be indicative of privilege escalation attempts or unauthorized resource manipulation within an AWS environment, as development endpoints provide an interactive environment for data processing.
This rule detects sign-in attempts originating from IP addresses that have been identified as infected with malware. These malware-infected IP addresses are known to actively communicate with bot servers, indicating a high risk of compromise or malicious activity associated with the sign-in.
This rule detects user activity that Azure AD Identity Protection has flagged as 'investigationsThreatIntelligence'. This risk event type indicates that a sign-in or user behavior is unusual for the user or consistent with known attack patterns, often leveraging threat intelligence feeds to identify suspicious activity. It suggests potential compromise of user accounts or malicious sign-in attempts.
This rule identifies when a DNS Zone is either modified or deleted within Google Cloud Platform. This activity is captured through specific Google Cloud DNS API calls: 'Dns.ManagedZones.Delete', 'Dns.ManagedZones.Update', and 'Dns.ManagedZones.Patch'. Such actions can indicate malicious activity aimed at disrupting services or redirecting traffic, or legitimate administrative changes.
This rule identifies activities related to Google Cloud Platform (GCP) Packet Mirroring. Packet Mirroring allows capturing full network traffic, which can be abused by adversaries to intercept and collect sensitive data from unencrypted internal network communications. The rule specifically looks for various API calls related to the creation, modification, deletion, or listing of Packet Mirroring configurations.
Detects when Microsoft Cloud App Security reports an activity originating from a country that has not been recently or ever visited by any user within the organization. This indicates potential unauthorized access or anomalous user behavior from an unusual geographic location.
This rule detects the execution of the 'cat' command used to append a zip file to an image file. This technique is commonly used in steganography to hide data within seemingly innocuous files. The rule specifically looks for 'cat' being executed with two arguments: one ending in a common image file extension ('.jpg' or '.png') and another ending in '.zip'. This pattern suggests an attempt to concatenate the contents of a zip file onto an image file.
Detects changes to critical syslog daemon configuration files on Linux hosts. Adversaries may modify these files to disable or reconfigure logging, thereby impairing defenses and hindering the detection of their activities.
Page 471 of 680