SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,506 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
See what commands are being input into the device by other people, full credentials can be in the history
Cisco Sniffing
Sigma
Show when a monitor or a span/rspan is setup or modified
Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam.
The usage of this RPC function should be rare if ever used at all.
Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.
View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'
The usage of this RPC function should be rare if ever used at all.
Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.
View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'
Detects the presence of default Cobalt Strike certificate in the HTTPS traffic
Identifies clients that may be performing DNS lookups associated with common currency mining pools.
DNS TOR Proxies
Sigma
Identifies IPs performing DNS lookups associated with common Tor proxies.
Detects download of certain file types from hosts in suspicious TLDs
Detects executable downloads from suspicious remote systems
Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs
Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string
Page 171 of 680