SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,603 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the creation or modification of AnyDesk configuration files (user.conf and system.conf) in the AppData\Roaming\AnyDesk directory. Adversaries often use legitimate remote access tools like AnyDesk to establish command and control, and the presence of these configuration files can indicate its use on a system. This rule helps identify the presence of AnyDesk artifacts, which could be indicative of legitimate use or malicious activity.
Detects the creation of specific log files associated with TeamViewer remote sessions. This can indicate the use of TeamViewer for remote access, which might be legitimate or malicious depending on the context.
Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE", "DROP DATABASE", or "TRUNCATE TABLE". These operations can lead to data loss and impact system availability.
Detects the execution of Action1, a Remote Monitoring and Management (RMM) tool, for arbitrary code execution or to establish remote sessions. The rule identifies these activities by looking for specific command-line patterns associated with Action1 agent deployments, script execution (via cmd.exe or powershell.exe), and the initiation of remote sessions through 'agent1_remote.exe'. The description also provides hunting opportunities to refine detection by baselining policy names and identifying remote sessions during abnormal hours.
Detects HTTP requests containing the URI pattern '/asp.asp?ui=' which is known to be used by the Chafer malware for command and control communication to receive data from its C2 server.
Detects potential CSharp Streamer RAT loading a .NET executable image by identifying a specific file name pattern and path commonly associated with the tool. This rule looks for image loads from a temporary directory with a filename matching 'dat[0-9A-Z]{4}\.tmp'.
Detects logons using NTLM to hosts that are potentially not part of the domain, specifically targeting Remote Desktop Protocol (RDP) connections. This could indicate an attempt to establish remote access to systems outside of the managed domain, potentially for lateral movement or persistence.
Detects incoming network connections to the AnyDesk remote access application. This activity could indicate an adversary attempting to establish a remote command and control channel or gain unauthorized access to a system using a legitimate remote access tool.
Detects potential Java webshell uploads to an SAP NetViewer server via HTTP POST requests with a 'Content-Type' of 'application/octet-stream' and URI stems containing '/irj/' and ending with '.jsp', '.class', or '.java'. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells.
This rule detects attempts to hijack the Amazon SSM Agent on Linux systems. Specifically, it looks for the 'amazon-ssm-agent' executable being run with command-line arguments indicative of registration with a new code, ID, and region. This behavior is consistent with the technique described in the Mitiga research report where the SSM agent can be abused as a remote access trojan for persistence and command and control.
Page 307 of 680