SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the execution of the extended stored procedure backdoor named Maggie in the context of Microsoft SQL server by looking for specific event IDs and the string 'maggie' in the event message.
Detects exploitation attempts of CVE-2024-50623 in Cleo software by identifying `cmd.exe` processes spawned from `javaw.exe` (associated with Cleo applications like Harmony, Lexicom, VersaLex, or VLTrader) that execute PowerShell commands with suspicious arguments indicative of encoded commands or web downloads.
Detects the invocation of PowerShell commands that reference classes from the "System.Security.Cryptography" namespace. This namespace provides classes for on-the-fly encryption and decryption, which can be abused by adversaries for defense evasion, such as decrypting malicious payloads.
This rule detects remote procedure calls (RPC) to modify the Windows Registry, which can be indicative of lateral movement or persistence mechanisms. Specifically, it monitors for RPC Firewall events with EventID 3 and an InterfaceUuid corresponding to the Remote Registry Protocol (338cd001-2244-31f1-aaaa-900038001003), focusing on specific operation numbers (OpNum) that represent various registry modification functions. This activity could be used by attackers to establish persistence, evade defenses, or execute code remotely.
Detects the S3 Browser utility performing reconnaissance by checking for existing AWS IAM Users without a LoginProfile defined, and subsequently creating a LoginProfile if one is not found. This behavior has been associated with the Guivil threat actor.
Detects when an account that has been disabled or blocked attempts to sign in. This could indicate an attacker attempting to use compromised credentials for an account that is no longer active or has been locked out due to suspicious activity.
Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.
Detects attempts to exploit the sudo vulnerability CVE-2019-14287, which allows a user to run commands as root without authentication by specifying a user ID of -1 or 4294967295.
Detects suspicious changes to file privileges using `chown` to set ownership to root and `chmod` to enable setuid (u+s) or setgid (g+s) bits. This activity can be indicative of privilege escalation or persistence mechanisms where an adversary attempts to run code with elevated privileges.
This rule detects when a member is removed from a security-enabled global group in a Windows environment. This activity is captured by Event IDs 633 and 4729 in the Windows Security event log. Such an action could indicate an attempt to reduce an account's privileges, remove an adversary's access, or modify group memberships for other malicious purposes.
Page 210 of 680