SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of suspicious files (jsp, java, class) in specific SAP NetWeaver directories. This activity may indicate an attempt to establish a webshell or exploit vulnerabilities, such as CVE-2025-31324, to gain persistent access or execute arbitrary code within the SAP environment.
Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \TASKNAME
Detects the execution of the 'curl.exe' process with specific flags that indicate an attempt to upload or exfiltrate data. This includes flags like '--form', '--upload-file', '--data', and variations of '--data-' (e.g., '--data-ascii', '--data-binary', '--data-raw', '--data-urlencode'), as well as shorthand flags like '-F', '-T', and '-d'. The rule filters out connections to localhost to reduce false positives.
Detects remote RPC calls to the ITaskSchedulerService interface, specifically focusing on operations that create or execute scheduled tasks. This behavior is commonly associated with lateral movement and persistence techniques. The rule leverages an RPC Firewall to monitor these specific RPC calls.
This rule detects the creation of virtual machines or the deployment of resources within an Azure environment. Monitoring these activities can help identify unauthorized resource provisioning, which could indicate an attacker establishing persistence, escalating privileges, or preparing for further malicious actions. The rule specifically looks for 'write' operations related to virtual machines and resource deployments in Azure activity logs.
This rule detects when a user is added to a group that has permissions to modify Conditional Access (CA) policies within Azure Active Directory. Such an action could indicate an attempt to escalate privileges, bypass existing security controls, or establish persistence by altering authentication processes.
This rule identifies when an organization's Azure Privileged Identity Management (PIM) service detects an 'invalidLicenseAlertIncident'. This indicates that the necessary Microsoft Entra Premium P2 or Microsoft Entra ID Governance license for PIM is either missing or has expired, leading to non-compliance and potential security risks related to privileged access management.
Detects when failed sign-in attempts increase by 10% or greater within Azure AD. This could indicate brute-force attacks, password spraying, or attempts to gain unauthorized access to accounts.
Detects when successful authentications to important applications occur using only single-factor authentication. This could indicate a weakened security posture for critical resources or a bypass of expected multi-factor authentication policies.
Detects the creation of files named "ebpfbackdoor" within the "cron.d" and "sudoers.d" directories. This activity is associated with the TripleCross eBPF rootkit, which uses these locations for persistence.
Page 205 of 680