SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,644 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects attempts to exploit the VMware Workspace ONE Access Authentication Bypass vulnerability (CVE-2022-31656). This vulnerability allows a malicious actor with network access to the UI to obtain administrative access without authentication by sending a specially crafted URI query.
Detects attempts to exploit an Apache Spark server via CVE-2022-33891, which is a shell command injection vulnerability, by looking for specific patterns in web server query strings.
Detects the creation of a "Report.wer" file in an uncommon folder structure, specifically outside of the typical Windows Error Reporting (WER) archive paths. This activity could indicate potential exploitation of CVE-2023-36874, where adversaries might manipulate WER to achieve execution or persistence.
Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism.
Detects the creation of new Windows services with specific names ('Name', 'msupdate', 'msupdate2') and an ImagePath containing '\Windows\System32\svchost.exe'. This pattern is associated with the COLDSTEEL RAT for persistence.
This rule detects the execution of 'rundll32.exe' with specific command-line arguments and parent processes that are characteristic of Qakbot malware activity. It looks for 'rundll32.exe' being launched by common scripting or command-line interpreters (cmd.exe, cscript.exe, curl.exe, mshta.exe, powershell.exe, pwsh.exe, wscript.exe) and attempting to load DLLs from suspicious paths (ProgramData, Users\Public, AppData\Local\Temp, AppData\Roaming). Additionally, it specifically targets known export functions used by Qakbot, such as 'aslr', 'bind', 'DrawThemeIcon', 'GG10', 'GL70', 'jhbvygftr', 'kjhbhkjvydrt', 'LS88', 'Motd', 'N115', 'next', 'Nikn', 'print', 'qqqb', 'qqqq', 'RS32', 'Test', 'Time', 'Updt', 'vips', 'Wind', 'WW50', 'X555', 'XL55', 'xlAutoOpen', and 'XS88'. This combination of indicators aims to reduce false positives by focusing on behaviors uniquely associated with Qakbot.
Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n', which is a known indicator of SNAKE malware activity as described by CISA. This specific registry key is used by SNAKE malware for covert storage.
Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This activity is associated with the SNAKE malware, as reported by CISA, which uses this technique for persistence.
This rule detects indicators of exploitation related to PaperCut MF/NG vulnerabilities. Specifically, it looks for command-line patterns associated with downloading and executing a malicious MSI installer. The first pattern identifies PowerShell commands using 'Invoke-WebRequest' to download 'setup.msi' with hidden window and no profile. The second pattern identifies 'msiexec' being used to install 'setup.msi' with a specific 'IntegratorLogin' parameter, which is a known indicator of the PaperCut exploitation.
Detects the execution of the 'echo' command with the '%userdomain%' environment variable. This activity can be used by adversaries to enumerate the domain a user is associated with, which is a common discovery technique.
Page 500 of 680