SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,639 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of 'net.exe' or 'net1.exe' with the command-line argument '/TRANSPORT:QUIC'. This combination indicates an attempt to mount Windows SMB shares over QUIC, which might be an unusual or unexpected activity in many enterprise environments. Adversaries could leverage this for lateral movement or data access.
Identifies when a Point-to-site VPN is Modified or Deleted in Azure. This could indicate an attacker attempting to disrupt network access or cover their tracks by removing or altering VPN configurations.
Detects when an administrator grants an application either application permissions (app roles) or highly privileged delegated permissions within an Azure environment. This action is logged in the Azure audit logs as 'Add app role assignment to service principal'. Such assignments can lead to persistence or privilege escalation if abused.
This rule identifies user activity originating from an IP address that has been flagged as an anonymous proxy. Such activity can indicate an attempt to obscure the true origin of a sign-in, which is often associated with malicious intent like credential stuffing, account takeover, or bypassing geographical restrictions.
This rule detects sign-in attempts originating from IP addresses identified as malicious by Azure AD Identity Protection, specifically when these attempts are characterized by a high failure rate. This indicates potential brute-force attacks, credential stuffing, or other unauthorized access attempts from known bad IP addresses.
Detects the use of the 'steghide' binary with the 'embed' command and specific flags ('-cf' or '-ef') to hide files using steganography. This technique can be used by adversaries to embed malicious payloads or sensitive data within legitimate-looking files, such as images, to evade detection.
Detects disabling security tools
Detects the creation of shell scripts (files ending with .csh or .sh) within the '/etc/profile.d/' directory. This directory is used to store shell scripts that are executed when a user logs in, making it a common target for adversaries to establish persistence or elevate privileges.
Detects the use of the 'wget' utility to download and create files within common temporary directories like '/tmp' or '/var/tmp' on Linux systems. This activity can be indicative of an adversary performing ingress tool transfer or staging malicious files.
This rule detects the use of the 'grep' command on Linux systems to identify information about the operating system's architecture. Adversaries often combine this activity with other discovery commands like 'uname' or 'cat /proc/cpuinfo' to gather system details. The rule specifically looks for 'grep' executions where the command line arguments include common architecture strings such as 'aarch64', 'arm', 'i386', 'i686', 'mips', or 'x86_64'. This activity is indicative of an attacker attempting to understand the environment they have compromised.
Page 514 of 680