SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,602 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious use of command-line tools such as curl or wget to download remote
content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by
immediate execution, indicating potential malicious activity. This pattern is commonly used
by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.
content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by
immediate execution, indicating potential malicious activity. This pattern is commonly used
by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.
This rule detects the execution of software whose metadata includes the description 'University of California, Berkeley'. This string is commonly associated with the BOINC (Berkeley Open Infrastructure for Network Computing) software. While BOINC is legitimate software used for volunteer computing, its unauthorized installation or use could indicate malicious activity, such as an adversary attempting to leverage system resources for their own purposes or as part of a larger compromise.
Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could indicate an attempt to exploit CVE-2020-1048, a Windows Print Spooler elevation of privilege vulnerability, by registering a malicious printer port.
This rule detects the execution of 'mstsc.exe' (Microsoft Terminal Services Client) when it attempts to open a local RDP file located in suspicious directories. Adversaries may place RDP files in these locations to establish remote desktop connections, potentially for persistence, lateral movement, or command and control. The rule specifically looks for 'mstsc.exe' being executed with a command line argument ending in '.rdp' or '.rdp"' and containing paths commonly associated with temporary files, public user folders, or system directories that are not typical for legitimate RDP file storage.
This rule detects attempts to hijack the Amazon SSM Agent by monitoring process creation events for the 'amazon-ssm-agent.exe' executable when it is launched with specific command-line arguments: '-register', '-code', '-id', and '-region'. This combination of arguments is indicative of an attacker attempting to register a compromised SSM Agent with a new AWS account or region, effectively turning it into a remote access trojan (RAT) as described in the referenced Mitiga research.
Detects the execution of "RegAsm.exe" without any command-line flags or specified files. This behavior is unusual for legitimate use of RegAsm.exe, which typically registers .NET assemblies or displays help information. Such execution patterns can indicate an attempt at process injection or other forms of defense evasion by adversaries abusing a trusted Windows utility.
This rule detects when the "BitsProxy.dll" is loaded by a process that is not part of a predefined list of legitimate system or application processes. The "BitsProxy.dll" is associated with the Background Intelligent Transfer Service (BITS) COM instance or API. Detecting its loading by uncommon processes can indicate suspicious activity, potentially related to adversaries abusing BITS for various purposes such as persistence, data transfer, or command and control.
This rule detects the execution of the GoToAssist remote access tool by looking for specific product and company metadata associated with the process. Adversaries often use legitimate remote access software like GoToAssist to establish command and control over compromised systems, blending in with normal IT support activities.
This rule detects the execution of LogMeIn Guardian Service (LMIGuardianSvc) based on its description, product name, or company name. LogMeIn is a legitimate remote access tool that can be abused by adversaries to establish command and control over compromised systems. The rule specifically looks for process creation events where the 'Description' or 'Product' field contains 'LMIGuardianSvc' or the 'Company' field is 'LogMeIn, Inc.'.
This rule detects the execution of the UltraViewer remote access tool. UltraViewer is a legitimate desktop support software that can be abused by adversaries to establish an interactive command and control channel to target systems. Detection is based on specific product, company, or original filename attributes associated with UltraViewer.
Page 310 of 680