SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,585 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic
Connection Proxy
Sigma
Detects setting proxy configuration
Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".
Setuid and Setgid
Sigma
Detects suspicious change of file privileges with chown and chmod commands
Detects a potentially suspicious execution of a process located in the '/tmp/' folder
Detects suspicious interactive bash as a parent to rather uncommon child processes
Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell
Detects usage of the "touch" process in service file.
Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges
Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script
Page 87 of 680