SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,644 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects common SQL exception types in Python applications as defined by PEP 249. These exceptions (DataError, IntegrityError, ProgrammingError, OperationalError) indicate issues during database operations, which could range from malformed queries to database connectivity problems or constraint violations. While often benign, repeated or unusual occurrences of these errors could signal application vulnerabilities being exploited (e.g., SQL injection attempts leading to syntax errors) or other malicious database interactions.
This rule identifies when a virtual network device in Azure, such as a network interface, network virtual appliance, virtual hub, or virtual router, is either modified or deleted. Monitoring these operations can help detect unauthorized changes or disruptions to network infrastructure.
Detects when a new owner is added to an application in Azure AD. This action grants the newly added account privileges to modify and configure the application, which could be abused by an attacker to maintain persistence, elevate privileges, or access sensitive data.
Identifies when a service account is modified, created, updated, enabled, or undeleted in Google Cloud. This rule specifically looks for API calls related to service account management, which could indicate an attacker establishing persistence, escalating privileges, or otherwise manipulating cloud resources.
This rule detects attempts to remove the immutable file attribute on Linux systems using the 'chattr' command with the '-i' flag. The immutable attribute prevents a file from being modified, deleted, or renamed, even by the root user. Adversaries may remove this attribute to modify critical system files or logs for defense evasion purposes.
This rule detects attempts to gather system and hardware information on Linux systems by monitoring access to specific files and directories that contain details about the BIOS version, product name, chassis vendor, SCSI devices, IDE hard drive models, kernel version, and operating system release information. Adversaries often access these files during the discovery phase to understand the environment they have compromised.
lnx_susp_dev_tcp
Sigma
Detects suspicious command with /dev/tcp
This rule detects outbound network connections from a Linux system to known Monero crypto mining pools. The detection is based on a predefined list of destination hostnames associated with various Monero mining operations. This activity is indicative of resource hijacking, where a system's computational resources are illicitly used for cryptocurrency mining.
This rule detects the usage of the 'chattr' utility with the '-i' flag to remove the immutable file attribute on Linux systems. Removing this attribute can allow adversaries to modify or delete critical system files that were previously protected, often as a defense evasion technique to hinder forensic analysis or remove persistence mechanisms.
Detects the usage of the 'crontab' utility with the '-r' flag to remove the current user's crontab. This activity can be indicative of an adversary attempting to remove scheduled tasks for defense evasion or to eliminate competition, such as in the case of cryptocurrency miners.
Page 502 of 680