SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts.
This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.
This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.
Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code.
Detects when a repository or an organization is being transferred to another location.
Detects the use of `systemctl mask` to disable system power management targets such as suspend, hibernate, or hybrid sleep. Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted. This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.
Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers. LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory. Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.
Detects the use of qoperation.exe with specific command-line arguments to write a JSP file to the webroot, indicating a webshell drop. This activity is associated with a post-authentication step related to CVE-2025-57790, which involves a path traversal vulnerability in Commvault.
This rule detects the use of 'wmic.exe' to perform system disk and volume reconnaissance. Specifically, it looks for command-line arguments related to querying volume names, logical disks, and general volume information. This activity has been observed in campaigns by threat actors such as Volt Typhoon.
Detects the execution of the 'sudo' command with the '--chroot' option, which is used to change the root directory for command execution. Attackers may use this technique to evade detection and execute commands in a modified environment. This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463. While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
Page 250 of 680