SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,544 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"
Detects execution of the bash shell with the interactive flag "-i".
Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
Detects command line parameters or strings often used by crypto miners
Curl Usage on Linux
Sigma
Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server
DD File Overwrite
Sigma
Detects potential overwriting and deletion of a file using DD.
Detects the use of grep to discover specific files created by the GobRAT malware
Page 628 of 680