SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,679 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects when a monitor, SPAN (Switched Port Analyzer), or RSPAN (Remote Switched Port Analyzer) is configured or modified on a Cisco network device. These configurations are often used for network sniffing or traffic analysis, which can be legitimate for troubleshooting but also abused by adversaries for data exfiltration or reconnaissance.
This rule detects the execution of 'show history', 'show history all', or 'show logging' commands on Cisco devices. These commands can expose sensitive information, including credentials, that have been entered into the device's command-line interface. Adversaries may use these commands to gather credentials or other sensitive configuration details from network devices.
Detects connections made by Microsoft BITSAdmin to domains using uncommon Top-Level Domains (TLDs). This can indicate command and control activity or data exfiltration where an adversary is attempting to blend in with legitimate traffic but using less common TLDs to avoid common filtering.
Detects exploitation attempts using the JNDI-Exploit-Kit by looking for specific URI patterns in web server logs. These patterns are indicative of various JNDI injection payloads designed to achieve remote code execution, reverse shells, or memory shell deployments on vulnerable applications like Tomcat, Jetty, Weblogic, JBoss, Websphere, and Spring.
This rule detects when the Background Intelligent Transfer Service (BITS) creates a new transfer job that saves a local file with a potentially suspicious extension. The suspicious extensions include '.bat', '.dll', '.exe', '.hta', '.ps1', '.psd1', '.sh', '.vbe', and '.vbs'. It specifically filters out common legitimate updates from applications like Chrome and Dropbox that download files into 'AppData' directories or from '.com' domains to reduce false positives.
This rule detects when the Windows Defender Firewall service fails to load Group Policy. This event can indicate an issue with the firewall configuration being applied, potentially leading to a weakened security posture or unexpected network behavior. Adversaries might attempt to interfere with firewall policy loading to bypass defenses.
This rule detects when the Windows Defender Firewall configuration has been reset to its default settings. This action can indicate an attempt by an adversary to disable or modify firewall rules to bypass network controls, facilitate C2 communications, or enable lateral movement. It specifically looks for Event IDs 2032 (for most Windows versions) and 2060 (for Windows 11) from the firewall-as log source.
Detect standard users login that are part of high privileged groups such as the Administrator group
Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.
Detects obfuscated use of `clip.exe` to execute PowerShell commands. This technique involves leveraging the Windows clipboard utility (`clip.exe`) in conjunction with command-line arguments that include `cmd` and `clipboard]::` to launch PowerShell, often as a method of defense evasion and execution.
Page 473 of 680