SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,564 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects an executable initiating a network connection to "ngrok" domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects access to vulnerable SharePoint components potentially being exploited in CVE-2025-53770 through IIS web server logs. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.
Detects potential exploitation of CVE-2025-53770, a zero-day vulnerability in SharePoint that allows remote code execution. The rule identifies indicators such as suspicious command lines discovered in post-exploitation activities, specifically looking for `w3wp.exe` as a parent process executing encoded commands or referencing `spinstall0.aspx` within SharePoint layout paths.
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
Detects an executable that isn't dropbox but communicates with the Dropbox API
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects the execution of a renamed binary often used by attackers or malware. This rule leverages the Sysmon 'OriginalFileName' data point to identify instances where a process's actual executable name (Image) differs from its original compiled file name. This technique is commonly used for defense evasion to masquerade malicious executables as legitimate system utilities.
Detects PowerShell scripts leveraging the "Invoke-WebRequest" cmdlet to send data via either "PUT" or "POST" method.
Detects a network connection initiated by a binary to "api.mega.co.nz".
Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.
Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.
Detects network connections to Cloudflared tunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Page 296 of 680