SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,603 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects remote RPC calls used by SharpHound to map remote connections and local group membership. This rule specifically targets the MS-WKST protocol (Workstation Service Remote Protocol) interface UUID and operation number associated with SharpHound's reconnaissance activities.
This rule detects attempts to enumerate local system groups on Linux. Adversaries often perform this discovery technique to understand the environment and identify users with elevated permissions. The rule triggers on execution of the 'groups' command or on common file viewing utilities (cat, ed, head, less, more, nano, tail, vi, vim) when they are used to read the '/etc/group' file.
Detects the execution of common text-based file access or inspection utilities to read the content of the '/etc/sudoers' file on Linux systems. This activity is often performed by adversaries to discover users with sudo rights, which can be a precursor to privilege escalation.
Identifies when a Kubernetes account accesses sensitive objects such as ConfigMaps or Secrets within Azure Kubernetes Service. This rule specifically looks for write or delete operations on these objects, which could indicate unauthorized access or malicious activity.
Detects attempts to record audio using the `arecord` and `ecasound` utilities on Linux systems. This rule specifically looks for the execution of `arecord` with common audio recording flags (`-vv`, `-fdat`) or the `ecasound` utility making a `memfd_create` syscall, which could indicate audio processing or recording.
This rule detects when an executable file (.exe) creates another executable file (.exe). This behavior can be indicative of malicious activity such as malware dropping its components, or legitimate software installers. The rule includes extensive filters to reduce false positives from common system processes, update utilities, and known application behaviors like those from Microsoft Teams, VS Code, and GitHub Desktop.
Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. The rule specifically looks for signatures containing common ransomware family names and keywords.
This rule identifies when sensitive ClusterRoles or Roles are being modified, deleted, or when their permissions are being escalated or bound in Azure Kubernetes Service (AKS). These operations can indicate an attempt to gain elevated privileges or disrupt access within the Kubernetes cluster.
This rule detects the execution of SharpView, a .NET port of PowerView, which is a popular PowerShell tool used for Active Directory reconnaissance. The rule specifically looks for the `SharpView.exe` executable or its command-line arguments containing various reconnaissance functions. These functions are commonly used by adversaries to discover information about domain computers, users, groups, trusts, policies, and network shares within an Active Directory environment.
Detects possible command execution by a web application or web shell by monitoring `execve` and `execveat` syscalls initiated by the web server's user ID (e.g., euid 33 for www-data). This rule specifically targets Linux systems using auditd for logging, requiring a specific auditd configuration to capture these events.
Page 313 of 680