SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,664 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil
Detects potential process and execution activity related to the APT10 Cloud Hopper operation. Specifically, it looks for `cscript.exe` executing VBScripts with a `/shell` argument and `csvde` commands attempting to export data to a log file in `C:\windows\web\`.
This rule detects suspicious process creation activity involving 'rundll32.exe' executing a DLL from a user's local application data directory, specifically looking for command-line patterns that include '.dat"' or '.dll #1'. This behavior is characteristic of the Sofacy (APT28) Trojan loader. The rule filters out executions from the temporary directory to reduce false positives.
Detects file indicators associated with a 2018 phishing campaign attributed to APT29 (Cozy Bear), as reported by Mandiant. The rule specifically looks for the creation or modification of files named 'ds7002.lnk', 'ds7002.pdf', or 'ds7002.zip'.
This rule detects potential activity associated with the EmpireMonkey APT group. Specifically, it looks for process creation events where the command line contains both '/e:jscript' and '\Local\Temp\Errors.bat'. This combination suggests the execution of a JScript file, possibly a malicious script, from a temporary directory, which is a common tactic used by threat actors for defense evasion and execution.
Detects CVE-2021-22123 exploitation attempt against Fortinet WAFs
Detects an authentication bypass vulnerability (CVE-2021-40539) affecting the REST API URLs in Zoho ManageEngine ADSelfService Plus. The rule specifically looks for requests to vulnerable endpoints that could be used to exploit this flaw.
Detects URL patterns and status codes that indicate a successful ProxyShell exploitation attack against Microsoft Exchange servers. The rule looks for requests to '/autodiscover.json' combined with specific URI paths like '/powershell', '/mapi/nspi', or '/EWS', and successful HTTP status codes (200 or 301).
Detects the creation of specific files associated with the Goofy Guineapig malware, which attempts to impersonate Google Update components. The rule looks for 'config.dat', 'GoogleUpdate.exe', 'tmp.bat', and 'goopdate.dll' within the 'C:\ProgramData\GoogleUpdate\' directory.
Detects the creation of a file named "MoriyaStreamWatchmen.sys" in the 'C:\Windows\System32\drivers\' directory. This specific filename is associated with the Moriya rootkit, as detailed in the Securelist's "Operation TunnelSnake" report. The presence of this file indicates a potential rootkit installation attempt, which could lead to persistence and privilege escalation on a Windows system.
Page 489 of 680