SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,603 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the execution of AnyDesk, a legitimate remote access tool. Adversaries often abuse such tools to establish command and control (C2) channels to target systems, as they are commonly allowed by application control and can blend in with normal network traffic. The detection logic looks for specific image names, descriptions, product names, or company names associated with AnyDesk during process creation events.
Detects the piping of a password to an AnyDesk instance via the command line using the '--set-password' flag. This technique can be used by adversaries to programmatically set a password for AnyDesk, potentially for remote access.
This rule detects the execution of AnyDesk, a legitimate remote access tool, from suspicious folders. Adversaries often use such tools to establish command and control channels. The rule specifically looks for AnyDesk executables (AnyDesk.exe or AnyDeskMSI.exe) that are not located in standard installation paths like 'Program Files' or 'AppData'.
Detects potential execution of MeshAgent which is a tool used for remote access.
Historical data shows that threat actors rename MeshAgent binary to evade detection.
Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.
Historical data shows that threat actors rename MeshAgent binary to evade detection.
Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.
Detects the execution of mshta.exe with command-line arguments that include file extensions not typically associated with HTML Application (HTA) content, such as image files (.png, .jpg), archives (.zip), documents (.pdf), and others. This behavior is often indicative of adversaries abusing mshta.exe, a legitimate Windows utility, to execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in Windows Server 2025 Active Directory environments. Successful usage of this tool can let attackers gain domain admin privileges by exploiting the BadSuccessor vulnerability.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects the use of command-line tools such as 'scp', 'rsync', and 'sftp' that are commonly used to copy files to or from remote systems. This activity can be indicative of an adversary transferring tools into an environment (Ingress Tool Transfer) or moving files laterally within a compromised network (Lateral Tool Transfer). The rule specifically looks for the presence of these tool names followed by a space and then a colon or an '@' symbol, which are characteristic of remote file operations.
Detects update checks performed by Advanced IP Scanner and Advanced Port Scanner utilities. These utilities are often used for network reconnaissance and can be considered Potentially Unwanted Applications (PUA) in some environments. The rule specifically looks for requests to '/checkupdate.php' with a set of specific query parameters, indicating an update check from these tools.
Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP. This activity can indicate an attacker exploiting a public-facing application to gain initial access and execute arbitrary commands.
Page 311 of 680