SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,639 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects activity that could be related to Baby Shark malware, specifically looking for command-line patterns indicative of its execution and discovery techniques. This includes the use of mshta.exe to execute HTA files via PowerShell, querying the registry for Terminal Server Client information, and using PowerShell to upload files.
Detects LockerGoga ransomware activity by identifying a specific command-line argument pattern used by the malware. The rule looks for the string '-i SM-tgytutrc -s' within process command lines, which is a known indicator of LockerGoga execution.
Detects potential BlueMushroom DLL loading activity via regsvr32 from the AppData Local directory. This technique is often used for defense evasion and execution of malicious code.
Detects the exploitation of the Microsoft Exchange vulnerability CVE-2020-0688, which is a remote code execution vulnerability. The rule specifically looks for an 'Error' level EventID 4 from the 'MSExchange Control Panel' provider, combined with the presence of '__VIEWSTATE=' in the event data, indicating an attempt to exploit the vulnerability via the Eventlog.
Detects exploitation attempts targeting the TerraMaster TOS vulnerability CVE-2020-28188. This rule specifically looks for GET requests to '/include/makecvs.php' with a '?Event=' parameter, combined with common command injection payloads such as 'curl', 'wget', '.py', '.sh', 'chmod', or '_GET' in the URI query.
Detects specific process characteristics associated with Maze ransomware droppers. This includes a temporary file being executed as a child process of WINWORD.exe, and the execution of wmic.exe to delete shadow copies, which is a common tactic for ransomware to inhibit system recovery.
Detects the exploitation of the Microsoft Exchange ProxyToken vulnerability (CVE-2021-33766), which is an authentication bypass. The rule looks for specific URI query patterns and HTTP POST methods combined with a 500 HTTP status code, indicating a potential exploitation attempt against the Exchange Control Panel (ECP) or related services.
Detects patterns indicative of the exploitation of the Serv-U CVE-2021-35211 vulnerability, specifically looking for the execution of 'whoami' in conjunction with specific file paths related to the Serv-U client. This activity has been associated with the threat group DEV-0322.
Detects patterns associated with DarkSide Ransomware and its helper processes. Specifically, it looks for command-line arguments used by DarkSide, such as '=[char][byte]('0x'+' or ' -work worker0 -path ', or the execution of an image from the 'AppData\Local\Temp\' directory when the parent process is 'DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}'.
Detects the creation of ".xml" and ".txt" files in folders within the "\AppData\Roaming\Microsoft" directory by specific uncommon processes. This behavior is associated with Devil Bait malware samples and stages as described by the NCSC.
Page 512 of 680