SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,658 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potential exploitation attempts of CVE-2022-21587, an arbitrary file upload vulnerability impacting Oracle E-Business Suite (EBS). This vulnerability can lead to unauthenticated remote code execution.
This rule detects potential exploitation attempts targeting the Centos Web Panel (CWP) 7, specifically looking for indicators related to CVE-2022-44877, an unauthenticated remote code execution vulnerability. The detection logic focuses on POST requests to '/login/index.php' containing specific query parameters and keywords often associated with reverse shells or command injection, such as 'login=$(' or base64 encoded 'python' strings.
This rule detects suspicious command line patterns associated with MERCURY APT activity. Specifically, it looks for PowerShell execution with parameters '-exec bypass -w 1 -enc' combined with a base64 encoded string that decodes to 'Start-Job -ScriptBlock'. This indicates the execution of an encoded PowerShell script, often used by adversaries to obfuscate their commands and evade detection.
This rule detects potential exploitation attempts of CVE-2023-23752, an improper access check vulnerability in Joomla's web service endpoints. The detection specifically looks for GET requests to the '/api/index.php/v1/' path with the 'public=true' query parameter, which is indicative of an attempt to bypass access controls.
Detects a crash of the "WinRAR.exe" application with a version lower than 6.23, which could indicate an attempted exploitation of CVE-2023-40477. The rule specifically looks for Application Error events (EventID 1000) where the provider is 'Application Error' and the crashing application is 'WinRAR.exe', excluding versions 6.23 and higher.
Detects the creation of a file named 'newdev.dll' in a user's AppData\Roaming directory. This specific file path and name are associated with the COLDSTEEL Remote Access Trojan (RAT) for persistence.
Detects the creation of a process executing as a user named "ANONYMOUS" where the parent process image path contains common system or user application directories. This behavior has been observed in the "MileStone2016" variant of the COLDSTEEL RAT.
This rule detects process creation events indicative of the Griffon malware. Specifically, it looks for command-line arguments that contain all of the following strings: '\local\temp\', '//b /e:jscript', and '.txt'. This pattern suggests the execution of a JScript file from a temporary directory, which is a known behavior of Griffon malware as reported by Kaspersky.
This rule detects the execution of 'rundll32.exe' when it is spawned by specific parent processes (cmd.exe, cscript.exe, curl.exe, mshta.exe, powershell.exe, pwsh.exe, wscript.exe) and the command line contains paths commonly used by Qakbot for persistence or execution (e.g., ProgramData, Users\Public, AppData\Local\Temp, AppData\Roaming) along with a '.dll' extension. This combination of indicators is often associated with Qakbot malware activity.
This rule detects the creation of files with the '.dmp', '.dump', or '.hdmp' extensions. These files are typically memory dumps generated by software during a crash. While often legitimate, memory dumps can contain sensitive information, including credentials, which could be exploited by adversaries. The rule aims to identify instances where such files are created to allow for investigation into the cause of the crash and to ensure no sensitive data is exposed or exfiltrated.
Page 490 of 680