SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,612 copies16 likes160,613 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners.
These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc.
Such DNS activity can indicate potential delivery or command-and-control communication attempts.
These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc.
Such DNS activity can indicate potential delivery or command-and-control communication attempts.
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".
Detects Deno writing a file from a direct HTTP(s) call to the AppData folder or introducing its own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through Deno.
Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR
Detects the creation of files with specific naming patterns, such as '\sessionresume_[a-zA-Z]{8}$', which are known to be used by the Impacket toolkit, particularly its secretsdump.py module. This activity often indicates an attempt to dump credentials from a compromised system.
Detects network connections with a suspicious user-agent string containing "katz-ontop", which may indicate Katz Stealer activity. This specific user-agent string is likely hardcoded or characteristic of the malware's C2 communication.
Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.
Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have been known to use this technique to extract sensitive information from the registry.
This rule detects processes that query known third-party application registry keys that are known to store credentials. The detection specifically looks for command-line arguments containing paths to registry keys associated with applications like Foxmail, DownloadManager, CoreFTP, IncrediMail, WinSCP, MobaXterm, OpenSSH, OpenVPN, Radmin, Eudora, RealVNC, B2, PuTTY, and TightVNC. This activity often indicates an adversary attempting to discover or extract credentials stored by these applications.
Page 327 of 680