SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,608 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.
An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks
Detects attempts by uncommon processes to access sensitive Microsoft Teams files, specifically those containing authentication tokens (leveldb) and cookies. This rule aims to identify potential credential theft or unauthorized access to user sessions within Microsoft Teams.
This rule detects the creation of a domain group named "ESX Admins" using either `net.exe` or PowerShell cmdlets like `New-ADGroup`. This activity is highly suspicious and indicates a potential exploitation attempt of CVE-2024-37085. This vulnerability allows an attacker to elevate privileges to full administrative access on a domain-joined ESXi hypervisor, as VMware ESXi hypervisors grant full administrative access by default to members of a domain group named "ESX Admins".
This rule detects the use of 'sc.exe' to query and enumerate services, specifically looking for the 'termservice'. Attackers often use 'sc.exe' to gather information about running services on a system, which can help them identify potential attack vectors or sensitive services. The detection focuses on the execution of 'sc.exe' with the 'query' command and the specific service 'termservice'.
This rule detects the creation of processes related to the NT Virtual DOS Machine (NTVDM), specifically `ntvdm.exe` and `csrstub.exe`. NTVDM allows 16-bit Windows applications and both 16-bit and 32-bit DOS applications to run on 32-bit Windows operating systems. While NTVDM is a legitimate Windows component, its execution might be unusual in modern environments, especially 64-bit systems where it's not natively supported, and could indicate an attempt to run legacy or potentially malicious 16-bit code.
Detects the execution of 'cmd.exe' specifically when initiated by the AnyViewer Remote Monitoring and Management (RMM) agent during a remote management session. This activity could indicate an adversary using the legitimate remote access tool to execute commands on a compromised system.
This rule detects attempts by uncommon applications to access cryptocurrency wallet files. It specifically looks for file access requests to common cryptocurrency wallet paths for Ethereum, Ethereum Classic, Monero, Bitcoin, BitcoinABC, BitcoinSV, DashCore, DogeCoin, Litecoin, Ripple, and Zcash. The rule filters out access by common system processes, applications installed in standard Program Files directories, and Windows Defender components to reduce false positives. This activity could indicate an attempt to steal cryptocurrency wallets.
Page 323 of 680