SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,605 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects corrupted packets sent to the MSMQ service, which could indicate an attempt to exploit CVE-2023-21554, a critical remote code execution vulnerability in Microsoft Message Queuing (MSMQ). The rule specifically looks for EventID 2027 with a Level of 2 (Error) from the 'MSMQ' provider in the Windows Application event log.
Detects the modification or deletion of Kubernetes RoleBindings or ClusterRoleBindings within Azure Kubernetes Service. These actions can indicate an adversary attempting to escalate privileges, maintain persistence, or disrupt services by altering access control configurations.
Detects when a Kubernetes CronJob or Job is created, modified, or deleted. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.
Detects AnyDesk writing binary files to disk other than "gcapi.dll".
According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll,
which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)
According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll,
which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)
Detects potential RDP connection via Mstsc using a local ".rdp" file
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects potentially suspicious child processes launched via the ScreenConnect client service.
Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR. This rule specifically looks for EventID 3 in the RPCFW EventLog, indicating a blocked or audited RPC call, and targets the InterfaceUUIDs associated with the Encrypting File System Remote (EFSR) protocol.
Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.). This often indicates an attempt to execute malicious code via Office applications, leveraging common living-off-the-land binaries (LOLBINs) or other suspicious executables.
This rule identifies rare subscription-level operations in Azure, specifically focusing on actions that involve listing keys for various Azure resources (DocumentDB, Maps, Media, Cognitive Services, Storage) or writing snapshots and network security groups. It aims to detect when these sensitive operations are performed from a previously unseen source IP address, indicating potential unauthorized access or credential compromise.
Page 316 of 680