SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,602 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects attempts to hijack legitimate RDP sessions to establish persistence on the RDP source machine. Specifically, it looks for file creation events where the 'mstsc.exe' process (Microsoft Remote Desktop Connection client) is involved in writing a file to a user's 'Startup' folder. This technique can be used by an attacker to place a backdoor or malicious executable that will run automatically when the user logs into the RDP source machine.
Detects antivirus alerts indicating the presence of exploitation frameworks or known offensive security tools. This rule emphasizes the importance of investigating such alerts, even if the malware is blocked, to understand the initial compromise vector.
Detects a specific user agent string and host ('api.dropbox.com') associated with an APT40 Dropbox tool, indicating potential data exfiltration or command and control activity via Dropbox.
Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic. This pattern often involves a hexadecimal string followed by two subdomains and a top-level domain.
Detects potential Remote Desktop Protocol (RDP) connections initiated via 'mstsc.exe' using a local '.rdp' file. This behavior can be indicative of an adversary establishing remote access to a system.
This rule detects the successful installation of the Atera Remote Monitoring & Management (RMM) agent by looking for specific Event ID 1033 from the MsiInstaller provider, where the message content includes 'AteraAgent'. This activity has been associated with threat actors, specifically Conti operators, using the Atera agent for command and control.
Detects an initiated network connection over uncommon ports from "dfsvc.exe". dfsvc.exe is a utility used to handle ClickOnce applications. Adversaries may abuse ClickOnce to proxy execution of malicious code, and unexpected network connections from this process, especially on non-standard ports, could indicate malicious activity.
Detects a DNS query to 'azurewebsites.net' originating from a process that is not a recognized web browser. Threat actors have frequently used 'azurewebsites.net' for malware hosting and data exfiltration. This rule aims to identify suspicious communication patterns where non-browser applications might be attempting to communicate with known malicious infrastructure hosted on Azure.
Detects potentially suspicious child processes launched via the ScreenConnect client service. This rule specifically looks for common Windows utilities being executed from a temporary ScreenConnect directory, which can indicate post-exploitation activity by an adversary using the remote access tool.
Detects the installation of the Mesh Agent service, which is commonly used for remote computer management. This rule specifically looks for Windows Event ID 7045 from the Service Control Manager, indicating a service installation, and then checks if the service's image path contains 'MeshAgent.exe' or if the service name contains 'Mesh Agent'.
Page 306 of 680