SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,642 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects attempts to exploit Apache Spark shell command injection vulnerabilities, specifically CVE-2022-33891, by monitoring for suspicious command-line executions involving 'id -Gn' as a child process of a bash shell. This indicates an attacker successfully injecting commands into the Spark environment.
Detects attempts to force stop the Uncomplicated Firewall (ufw) using the 'ufw-init' script with the 'force-stop' argument, or disabling ufw using the 'ufw disable' command. This activity can indicate an adversary attempting to bypass host-based firewall controls to facilitate network communications for C2, lateral movement, or data exfiltration.
Detects the usage of utilities such as 'systemctl', 'service', and 'chkconfig' to stop or disable services on a Linux system. This activity can be indicative of an adversary attempting to impair defenses or disrupt system operations.
Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell
Detects the creation of a new local user account on macOS systems using either the 'dscl' or 'sysadminctl' commands. Such accounts may be used for persistence without requiring persistent remote access tools.
zeek_dns_nkn
Sigma
NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>
This rule detects the execution of PsExec or PAExec when the service name has been renamed from its default 'PSEXESVC'. It specifically looks for SMB file access events (smb_files) in Zeek logs where the path contains '\IPC$' and the name ends with '-stdin', '-stdout', or '-stderr', but filters out events where the name starts with 'PSEXESVC'. This helps to identify potentially malicious use of PsExec-like tools that attempt to evade detection by altering the service name, while reducing noise from legitimate PsExec usage or other PsExec clients.
This rule detects a specific threading-related error message in Apache HTTP Server error logs. The error message indicates an issue with priority changes for pthreads, specifically an assertion failure related to `__pthread_tpp_change_priority`. This could be indicative of an underlying problem with the Apache server's threading model, potentially caused by misconfigurations, incompatible modules, or resource exhaustion. While the rule itself doesn't directly detect an attack, such errors could be exploited or could be a symptom of a system under stress or compromise.
This rule detects successful attempts to exploit the IIS shortname vulnerability, which allows enumeration of folders when IIS uses an old .Net Framework. The detection logic looks for HTTP GET or OPTIONS requests to URIs containing '~1' and ending with 'a.aspx', combined with successful HTTP status codes (200 or 301). This pattern is indicative of a successful fuzzing scan for the IIS shortname vulnerability.
This rule detects attempts to enumerate source code repositories, specifically Git repositories, by looking for '.git/' in the URL of GET requests. This activity often indicates an attacker attempting to discover exposed source code.
Page 503 of 680