SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,545 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects calls to hidden files or files located in hidden directories in NIX systems.
Detects the ld.so preload persistence file. See `man ld.so` for more information.
Detects disabling security tools
Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log files and directories.
Adversaries often try to clear logs to cover their tracks after performing malicious activities.
Adversaries often try to clear logs to cover their tracks after performing malicious activities.
Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system
Detects the use of Python's base64 decoding functions in command line executions on Linux systems.
Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
Detects usage of base64 utility to decode arbitrary base64-encoded text
Detect file time attribute change to hide new or changes to existing files
Detects attempts to enable the root account via "dsenableroot"
Show when private keys are being exported from the device, or when new certificates are installed
Page 57 of 680