SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.
It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
This rule detects the execution of 'netsh.exe' with command-line arguments indicating an attempt to discover firewall configurations. Specifically, it looks for 'netsh' combined with 'show firewall' and additional keywords like 'config', 'state', or 'rule', or 'name=all'. This activity is often performed by adversaries to understand the network environment and identify potential egress points or defensive measures.
Detects the image load of 'vsstrace.dll' by executables that are not typically associated with legitimate Windows operations or known backup solutions. This behavior can indicate an adversary attempting to manipulate or delete Volume Shadow Copies, often as a precursor to data encryption for impact (ransomware) or to hinder system recovery.
This rule detects common PowerShell download and execution cradles. It looks for command-line arguments that indicate an attempt to download content from the internet (e.g., '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', 'iwr', 'Invoke-RestMethod', 'irm') combined with immediate execution (e.g., ';iex $', '| IEX', 'Invoke-Expression'). These patterns are frequently used by adversaries to fetch and execute malicious scripts or payloads directly in memory.
This rule detects the usage of the 'ssh.exe' binary as a proxy to launch other programs. This technique can be abused by adversaries for defense evasion and to execute arbitrary commands. The detection specifically looks for 'ssh.exe' being spawned by 'sshd.exe' or for 'ssh.exe' command lines containing 'ProxyCommand=' or 'PermitLocalCommand=yes' and 'LocalCommand'.
This rule detects the execution of WinRAR (rar.exe or winrar.exe) from a directory that is not its standard installation path (e.g., 'Program Files\WinRAR'). It specifically excludes 'UnRAR.exe' executions and also filters out executions from the Windows temporary directory ('Windows\Temp') to reduce false positives. This behavior can be indicative of an adversary using a portable or custom-dropped version of WinRAR for archiving data prior to exfiltration, or for other malicious purposes.
Detects the execution of Python web servers via command line interface (CLI).
After gaining access to target systems, adversaries may use Python's built-in HTTP server modules to quickly establish a web server without requiring additional software.
This technique is commonly used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems.
After gaining access to target systems, adversaries may use Python's built-in HTTP server modules to quickly establish a web server without requiring additional software.
This technique is commonly used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems.
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.
This rule detects the use of alternate PowerShell hosts, which adversaries might leverage to bypass security detections that specifically monitor 'powershell.exe'. It identifies PowerShell module loads where the 'ContextInfo' field does not correspond to standard PowerShell executables or known legitimate applications that host PowerShell, such as sdiagnhost.exe, ConfigSyncRun.exe, dsac.exe, or wsmprovhost.exe. The rule also filters out common PowerShell help update activities.
Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.
Page 254 of 680