SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,520 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the creation of a process using 'ssh.exe' with command-line arguments indicative of remote port forwarding. Specifically, it looks for the '-R' flag, which is used to specify remote port forwarding in SSH. This activity can be used by adversaries for command and control or lateral movement by tunneling network communications.
Detects DNS resolution of an .onion address related to Tor routing networks
Detects DNS queries to an ".onion" address related to Tor routing networks
This rule detects the execution of the 'getcap' binary on Linux systems. Adversaries often use 'getcap' during reconnaissance to identify binaries with special capabilities that could be exploited for privilege escalation, such as GTFOBins or other vulnerable executables. The rule specifically looks for the use of 'getcap' with the '-r' flag, which recursively lists capabilities.
This rule detects the execution of the `certutil.exe` utility specifically when it is used with the `-exportPFX` flag. This flag allows `certutil.exe` to export certificates, potentially including private keys, into a Personal Information Exchange (PFX) file. This activity can be indicative of an adversary attempting to steal credentials or establish persistence by exporting legitimate certificates for later use in impersonation or decryption.
Detects the creation of a new Windows service (EventID 7045) where the service's ImagePath contains suspicious command-line flags ('-c', '-r', '-k') often used with scripting engines, and the ImagePath itself references common scripting or proxy execution binaries such as cscript, mshta, powershell, pwsh, regsvr32, rundll32, or wscript. This combination indicates an attempt to install a service that executes a script or uses a living-off-the-land binary for malicious purposes, potentially for persistence or privilege escalation.
This rule detects the execution of 'cmdkey.exe' with the '-l' argument, which is used to list cached credentials on a Windows system. This activity is often associated with reconnaissance for cached credentials by adversaries.
Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
This rule detects the execution of any process that originates from the '/tmp/' directory on a Linux system. The '/tmp/' directory is often used by adversaries to stage and execute malicious payloads, as it is typically writable by all users and can be used to bypass certain security controls. The rule specifically excludes executions of '/usr/bin/nextcloud' from '/tmp/' to reduce false positives.
Detects the execution of "findstr" with specific command-line flags and a remote share path. This combination of flags allows "findstr" to download the content of a file located on a remote share, as described in the LOLBAS project. This technique can be used for ingress tool transfer or data staging.
Page 282 of 680