SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,682 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of the 'steghide' utility to extract hidden files from image files (JPG or PNG). Adversaries may use steganography to conceal data and evade detection.
Detection rule generated by AI system
Detects attempts to exploit the Shellshock vulnerability (CVE-2014-6271) by looking for specific shellshock expressions in log files. These expressions are commonly used to inject and execute arbitrary commands.
Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts. These errors often suggest malformed requests or attempts to trigger vulnerabilities in the VSFTPD service.
Detects the creation of a new named pipe using the 'mkfifo' utility on Linux systems. Named pipes can be used for inter-process communication and can sometimes be leveraged by adversaries for various purposes, including data exfiltration, command and control, or as a component of more complex malware.
Detects the execution of netcat or ncat with the '-e' or '-c' flag, combined with common shell commands. This pattern is indicative of an attempt to establish a reverse shell, where a shell is spawned and connected back to an attacker-controlled listener.
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite. This activity is indicative of the OMIGOD vulnerability exploitation.
This rule detects attempts to disable security tools on Linux systems. Specifically, it looks for command-line invocations of `iptables`, `ip6tables`, `firewalld`, `cbdaemon` (Carbon Black), `falcon-sensor` (CrowdStrike), and `setenforce` (SELinux) with arguments indicating a stop or disable action. This activity is often associated with adversaries attempting to impair defenses to facilitate further malicious actions.
Detects the execution of 'xterm' with command-line arguments indicative of a reverse shell connection, specifically looking for '-display' and a display value ending in ':1'. This pattern is commonly used by attackers to establish a reverse shell.
Detects suspicious child processes spawned from web browsers on macOS. This activity often indicates a potential web browser exploitation attempt, where an attacker leverages a browser vulnerability to execute arbitrary commands or scripts on the system. The rule specifically looks for common scripting and command-line interpreters being launched as child processes of various browsers, while filtering out known legitimate browser-related activities like updates or recovery scripts.
Page 472 of 680