SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,671 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects specific command-line patterns associated with FIN7's reconnaissance and POWERTRASH execution, as reported by WithSecureLabs. It looks for PowerShell commands that include '-noni -nop -exe bypass -f \\' and 'ADMIN$' or '-ex bypass -noprof -nolog -nonint -f' and 'C:\Windows\Temp\'. These patterns indicate attempts to execute PowerShell scripts, potentially for remote access or privilege escalation, often targeting administrative shares or temporary directories.
This rule detects the use of specific Windows API (WinAPI) libraries within PowerShell scripts. Attackers often leverage direct WinAPI calls from PowerShell to bypass typical detection mechanisms that focus on standard PowerShell function calls. The rule specifically looks for the presence of 'Advapi32.dll', 'kernel32.dll', 'KernelBase.dll', 'ntdll.dll', 'secur32.dll', and 'user32.dll' within the PowerShell script block text. This can indicate attempts to perform low-level system operations or interact with the operating system in a way that might evade higher-level monitoring.
Detects the use of 7-Zip utilities (7z.exe, 7za.exe, and 7zr.exe) to extract password-protected compressed files. This activity can be indicative of an adversary decompressing sensitive data or malware that was archived with a password, potentially as part of collection or staging activities.
Detects the use of the redirection character ">" in command-line arguments of `cmd.exe`. This technique is often used by malicious actors to redirect the output of reconnaissance commands (e.g., `hostname`, `dir`) to files for later exfiltration.
This rule detects the creation of scheduled tasks by monitoring specific registry key paths associated with the Windows Task Scheduler. Adversaries often use scheduled tasks for persistence, privilege escalation, or execution of malicious code. By observing modifications to these registry paths, the rule aims to identify when new scheduled tasks are being registered on a system.
This rule detects potential JNDI (Java Naming and Directory Interface) injection exploitation attempts within JVM-based applications. It specifically looks for keywords related to LDAP lookups ('com.sun.jndi.ldap.') and the Log4j JndiManager ('org.apache.logging.log4j.core.net.JndiManager') in application error logs. Such patterns are commonly associated with vulnerabilities like Log4Shell, where attackers inject malicious JNDI lookup strings to achieve remote code execution.
Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts. These exceptions often occur when an attacker is probing a web application for vulnerabilities or attempting to bypass security controls like CSRF tokens, or sending malformed requests.
Detects suspicious exceptions within the Spring framework that could indicate attempts to exploit vulnerabilities. These exceptions often arise during web application attacks such as CSRF attempts, cookie theft, or other forms of unauthorized access or manipulation.
Detects potential Spring Expression Language (SpEL) Injection exploitation attempts, which can lead to Remote Code Execution (RCE). The rule specifically looks for the 'org.springframework.expression.ExpressionException' keyword in application error logs, indicating that an attempt to evaluate a malicious expression might have occurred or failed.
Detects when an AWS EFS Fileshare is deleted. This action can indicate an attempt to disrupt availability or destroy data. Adversaries might delete file systems to impact operations or cover their tracks. Note that an EFS file system cannot be deleted if it has active mount targets, implying that mount targets would need to be deleted first.
Page 480 of 680