SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,653 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects process access to 'verclsid.exe' that involves injecting shellcode, originating from a Microsoft Office application or VBA macro. This behavior is indicative of malicious activity, potentially leveraging 'verclsid.exe' for defense evasion and privilege escalation.
Detects exploitation attempts targeting CVE-2020-0688, a remote code execution vulnerability in Microsoft Exchange Server. The rule specifically looks for requests to '/ecp/default.aspx' containing '__VIEWSTATEGENERATOR=' and '__VIEWSTATE=' in the query string, which are indicators of the exploit.
This rule detects exploitation attempts using the Pulse Connect Secure (PCS) vulnerability CVE-2021-22893. The detection logic looks for specific URI query patterns commonly associated with this exploit.
Detects suspicious access to specific URLs associated with the exploitation of the ADSelfService Plus vulnerability CVE-2021-40539. Attackers have been observed targeting these URLs to exploit the vulnerability.
Detects Microsoft Office applications executing child processes that include directory traversal patterns in their command line. This behavior is indicative of exploitation attempts, specifically referencing vulnerabilities like CVE-2022-30190 (MSDT RCE, also known as Follina) and CVE-2021-40444 (MSHTML RCE). The rule looks for common Office applications as parent processes and specific directory traversal strings in the child process's command line.
Detects exploitation attempts of Sitecore Experience Platform Pre-Auth RCE CVE-2021-42237. This vulnerability allows for remote code execution without authentication. The rule specifically looks for POST requests to the '/sitecore/shell/ClientBin/Reporting/Report.ashx' endpoint that result in a 200 HTTP status code, indicating a successful interaction with the vulnerable component.
This rule detects the creation of an executable file named "msiexec.exe" within the 'bin' directory of a ManageEngine SupportCenter Plus installation. This specific file creation pattern is associated with the exploitation of CVE-2021-44077, a vulnerability for which public Proof-of-Concept (POC) exploits are available. The presence of a newly created 'msiexec.exe' in this non-standard location within the application's directory indicates potential compromise and malicious activity, as legitimate 'msiexec.exe' is a system binary typically located in system directories.
Detects URL patterns indicative of ProxyShell exploitation attempts against Microsoft Exchange servers. The rule looks for specific URI query strings and HTTP status codes (401) that are characteristic of both failed and successful exploitation attempts.
Detects an exploitation attempt of the SystemNightmare vulnerability, which aims to obtain a shell with LOCAL_SYSTEM privileges. The rule specifically looks for command-line arguments associated with known exploitation tools or techniques related to SystemNightmare, such as references to 'printnightmare.gentilkiwi.com', '/user:gentilguest', or 'Kiwi Legit Printer'.
This rule detects potential Command and Control (C2) communication associated with the Goofy Guineapig backdoor. It specifically looks for HTTP/S requests originating from a user agent string characteristic of the malware ('Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36') communicating with the domain 'static.tcplog.com'. This combination of user agent and destination domain is indicative of Goofy Guineapig C2 activity.
Page 499 of 680