SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,612 copies16 likes160,613 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.
Detects the loading of specific DLLs associated with Katz Stealer malware, particularly variants from 2025. The presence and loading of these DLLs strongly indicate malicious activity on the system, as Katz Stealer is known for stealing sensitive information.
Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant known for stealing sensitive information. In enterprise environments, such DNS queries may indicate potential malicious activity or compromise.
Detects attempts to execute remote commands, within a Pod's container using e.g. the "kubectl exec" command.
Detects enumeration of Kubernetes secrets.
Detects attempts to inject a sidecar container into a running deployment.
A sidecar container is an additional container within a pod, that resides alongside the main container.
One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation.
By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.
A sidecar container is an additional container within a pod, that resides alongside the main container.
One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation.
By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.
Detects instances where an FTP service on an OpenCanary node has had a login attempt.
Detect the update check performed by Advanced IP/Port Scanner utilities.
Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.
Page 328 of 680