SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects specific command-line characteristics associated with the Winnti Pipemon malware, as reported by ESET. The rule looks for `setup0.exe -p` or `setup.exe` with command-line arguments ending in `-x:0`, `-x:1`, or `-x:2`.
Detects the creation or modification of specific files associated with the exploitation of Windows vulnerabilities CVE-2021-31979 and CVE-2021-33771, and the deployment of DevilsTongue malware by the threat group Sourgum. The rule specifically looks for the presence of certain filenames in critical system directories.
Detects the loading of 'oci.dll' by 'msdtc.exe', which is indicative of the Pingback backdoor. This backdoor is known to establish an ICMP tunnel for command and control communication.
Detects a specific command line argument being passed to a binary, which has been observed in use by the Small Sieve malware. The rule specifically looks for command lines ending with '.exe Platypus'.
Detects potential sideloading of malicious "aclui.dll" by OleView. This behavior was observed in Raspberry-Robin variants reported by Checkpoint Research in February 2024. The rule specifically looks for OleView.exe loading aclui.dll, while filtering out known legitimate paths and signed executables to reduce false positives.
Detects the setting of a DLL that handles a custom protocol handler, specifically targeting a CLSID observed in attacks attributed to Forest Blizzard APT. This technique can be used for persistence or privilege escalation by registering a malicious DLL to be loaded when a specific protocol is invoked.
Detects file access requests to files ending with either the ".hive" or ".reg" extension, which are typically associated with Windows Registry backups. The rule specifically looks for these accesses by applications not located in common system directories (C:\Program Files (x86)\, C:\Program Files\, C:\Windows\System32\, C:\Windows\SysWOW64\), indicating potentially suspicious activity by uncommon or unauthorized applications.
Detects changes to the registry keys related to "Trusted Location" of Microsoft Office. Attackers might add additional trusted locations to avoid macro security restrictions.
Detects the creation of an Inline IAM policy by the 'S3 Browser' utility, where the policy still contains the default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>" instead of a specific bucket name. This indicates a potential misconfiguration or an attempt to create a broad policy that might be further exploited.
This rule detects successful user authentications originating from geographic locations (countries) that are not designated as operational areas for the organization. This helps identify potential unauthorized access attempts or compromised accounts being used from unexpected locations.
Page 220 of 680