SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious file writes to the root directory of web applications, specifically targeting Apache or Tomcat servers. This activity often indicates an attempt to deploy malicious files like web shells or other unauthorized scripts, potentially after exploiting a public-facing application.
This rule detects the use of various operating system utilities to discover local accounts, system owners, or users. It specifically looks for the execution of `whoami.exe`, `quser.exe`, `qwinsta.exe`, `wmic.exe` with 'useraccount' and 'get' in the command line, `cmdkey.exe` with the '/l' flag, `cmd.exe` executing 'dir \Users\', and `net.exe` or `net1.exe` with 'user' in the command line, while filtering out common legitimate uses of `net` and `cmd dir` commands.
This rule detects suspicious failed logon attempts by monitoring specific uncommon error codes. These error codes indicate issues such as logons to disabled accounts, attempts outside authorized hours, from unauthorized workstations, or due to trust relationship failures or insufficient logon rights. Such failures can suggest an adversary attempting to bypass security controls or test account validity and permissions.
Detects the use of argument injection in the Commvault qlogin command, specifically targeting CVE-2025-57791. An attacker can inject the `-localadmin` parameter via the password field to bypass authentication and gain a privileged token.
Detects when a Microsoft Office application (Word, Excel, PowerPoint, Outlook, WordView) initiates an outbound network connection to an IP address that is not a private IP range or a known Microsoft/Akamai IP range. This rule aims to identify suspicious network activity from Office applications, potentially indicative of malware or exploitation, similar to behavior seen in CVE-2021-42292. Initial baselining and tuning are required to adapt to specific organizational environments.
Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.
Detects access to known sensitive file extensions on network shares. This can indicate an adversary attempting to collect sensitive data such as backups, memory dumps, Kerberos tickets, or various email/messaging data files.
Detects the execution of suspicious commands often used in Command and Control (C2) activities, as identified in Florian Roth's 'Best Practice Auditd Configuration'. These commands include `wget`, `curl`, `base64`, `nc`, `netcat`, `ncat`, `ssh`, `socat`, `wireshark`, `rawshark`, `rdesktop`, and `nmap`. These tools can be leveraged for various adversarial techniques such as data transfer, remote access, network discovery, and data encoding.
Detects PowerShell processes executing commands that utilize `Net.WebClient` to download content, indicated by the presence of `new-object`, `net.webclient).`, and `download` keywords in the command line, along with either `string(` or `file(`. This pattern is commonly used by adversaries for ingress tool transfer or to fetch additional malicious payloads.
This rule detects the use of various command-line tools and PowerShell cmdlets that can initiate web requests. These include native Windows PowerShell cmdlets like 'Invoke-RestMethod', 'Invoke-WebRequest', 'Resume-BitsTransfer', 'Start-BitsTransfer', and their aliases ('irm', 'iwr'), as well as common command-line utilities like 'curl' and 'wget', and .NET framework calls such as '[System.Net.WebRequest]::create' and 'WinHttp.WinHttpRequest'. Adversaries often use these methods to download additional tools, malware, or exfiltrate data from a compromised system.
Page 251 of 680