SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,659 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects possible malicious execution of JavaScript for Automation (JXA) in-memory via the `osascript` utility on macOS. This rule specifically looks for command-line executions of `osascript` that include the `-e` flag (for executing a script string), the `eval` function, `NSData.dataWithContentsOfURL` (indicating potential remote content loading), and either explicitly specifies 'JavaScript' as the language or includes '.js' in the command line.
Detects the use of WebDAV by a client, specifically identifying the 'Microsoft-WebDAV-MiniRedir/' user agent during a GET request. This behavior is often associated with 'DownloadCradle' techniques used by adversaries to download malicious content or exfiltrate data.
Detects attempts to download a Flash Player update from a suspicious, non-official location. This rule specifically looks for requests containing '/flash_install.php' or ending with '/install_flash_player.exe' that do not originate from a legitimate Adobe domain.
Detects HTTP User-Agent strings that end with an equal sign, which can be an indicator of Base64 encoding. This technique is often used by malware to obfuscate C2 communications.
Detects the execution of Sysinternals tools that have been installed via an AppX package. This method of deployment might be used by attackers to bypass detection mechanisms that rely on monitoring standard system paths for these tools.
Detects the creation of a new Background Intelligent Transfer Service (BITS) job by PowerShell. Adversaries may abuse BITS jobs for persistence, execution, or data transfer, and using PowerShell to create these jobs is a common method.
Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location, such as Desktop, C:\Users\Public\, or C:\PerfLogs\.
This rule detects attempts to export an Exchange Certificate Signing Request (CSR) to an unusual directory or with an .aspx file extension. This activity is suspicious because it could indicate an adversary attempting to place a webshell on an Exchange web server for persistent access. The rule specifically looks for the PowerShell cmdlet 'New-ExchangeCertificate' with parameters '-GenerateRequest', '-BinaryEncoded', and '-RequestFile', combined with suspicious file paths like '\\localhost\C$', '\\127.0.0.1\C$', 'C:\inetpub', or the '.aspx' extension.
This rule detects attempts to modify the 'ExternalUrl' property of an Exchange OabVirtualDirectory to include script-related keywords. This activity can indicate an adversary attempting to establish persistence or execute malicious code by injecting a web shell or similar mechanism into the Exchange server's Outlook Web Access (OWA) configuration.
Detects an attempt to install a device that is forbidden by the system policy, indicated by Windows Security Event ID 6423. This event signifies that a device installation was blocked due to a configured policy.
Page 493 of 680