SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,517 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses.
This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
This rule will require an initial baseline and tuning that is specific to your organization.
This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
This rule will require an initial baseline and tuning that is specific to your organization.
This rule detects when a non-Python process loads the "Python Core" image. This behavior is often indicative of an executable that has been bundled from Python code using tools like Py2Exe, PyInstaller, or cx_Freeze. Threat actors commonly use these tools to package malicious Python scripts into standalone executables, which can help obfuscate their code or bypass security measures. The rule filters out legitimate Python processes and common installation paths to reduce false positives.
This rule identifies DNS lookups associated with common Tor proxies and services. It detects queries for domains ending in '.onion' and various Tor gateway domains (e.g., '.hiddenservice.net', '.tor2web.com', '.tor-gateways.de'). This activity can indicate the use of the Tor network for anonymization, which adversaries may leverage for command and control, data exfiltration, or to obscure their malicious activities.
This rule detects instances where 'conhost.exe' spawns an uncommon child process. Typically, 'conhost.exe' should only spawn itself or specific system processes. The detection of other child processes could indicate malicious activity, such as the use of 'conhost.exe' as a Living Off The Land Binary (LOLBIN) for indirect command execution or as a vector for process injection. The rule specifically filters out legitimate 'conhost.exe' child processes and cases where the child process image is null or empty, focusing on unexpected executables.
Detects the creation or modification of specific files identified as indicators of compromise (IOCs) used by UNC4841 in their exploitation of Barracuda ESG appliances. These files are associated with various stages of the attack, including persistence, execution, and defense evasion.
This rule detects DNS resolution attempts for domains associated with Tor onion services and Tor2web gateways. It specifically looks for DNS queries ending with various Tor-related top-level domains and subdomains, indicating potential use of the Tor network for anonymization or accessing hidden services.
Detects the execution of JavaScript or JSC files using the Node.js binary (node.exe). This activity can be suspicious as adversaries have been observed abusing Node.js to disguise malware, evade security defenses, and maintain persistence. While Node.js is commonly used, unusual occurrences of this activity in an environment warrant immediate investigation.
Detects potentially suspicious inline JavaScript execution using the Node.js binary. The rule specifically looks for the execution of 'node.exe' combined with command-line arguments that contain keywords indicative of malicious activity, such as 'http' (for network communication), 'execSync' or 'spawn' (for executing system commands), 'fs' (for file system operations), 'path', and 'zlib' (often used in unpacking or data manipulation). This combination suggests an attempt to execute arbitrary code or perform system interactions via Node.js.
Detects the execution of the 'FileGrabber' component of the Amos infostealer on macOS. This rule specifically looks for command-line arguments containing both 'FileGrabber' and '/tmp', indicating the execution of this malicious component, which is known to target sensitive user files.
Detects DNS queries to an ".onion" address or other domains associated with Tor routing networks and Tor2web proxies. This indicates potential use of Tor for anonymous communication or access to dark web services.
Page 274 of 680