SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,567 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of files with double extensions, a common technique used by malware to masquerade as benign files, especially when Windows is configured to hide known file extensions. This rule specifically looks for files ending with common executable or archive extensions (like .exe, .iso, .rar, .zip, .svg) preceded by another common file extension (like .doc, .pdf, .jpg, .png, etc.).
This rule detects suspicious network connections to Dropbox API endpoints (api.dropboxapi.com or content.dropboxapi.com) originating from any executable that is not the legitimate Dropbox application. This behavior can indicate an adversary using a non-standard or malicious process to exfiltrate data or establish command and control via Dropbox.
Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.
Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse this feature to establish a reverse shell, persistence, or exfiltrate data from a compromised machine.
Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse this feature to establish a reverse shell or persistence on a machine.
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
Detects the creation of specific files (spinstall.aspx, spinstall?.aspx, debug_dev.js) within SharePoint's Web Server Extensions template layouts directory. This activity is indicative of successful exploitation of CVE-2025-53770, a zero-day vulnerability in SharePoint that allows remote code execution.
Detects when a non-browser process initiates network communication with the Telegram API. This activity is suspicious as it could indicate the use of Telegram for covert command and control (C2) or data exfiltration by malware, bypassing typical browser-based interactions.
This rule detects network connections initiated by any binary to the domains 'mega.co.nz' or 'mega.nz'. Attackers have been observed using file-sharing services like MEGA for uploading and downloading additional payloads, facilitating data exfiltration or staging. This detection aims to identify such suspicious communication patterns.
Page 294 of 680