SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,612 copies16 likes160,613 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.
This rule detects the launch of web browsers (both Chromium-based and Firefox) with command-line arguments that enable remote debugging. This functionality, while legitimate for developers, can be abused by attackers to inject malicious code, steal credentials, or perform browser session hijacking. The rule specifically looks for '--remote-debugging-' in Chromium-based browsers and '-start-debugger-server' in Firefox.
Detects the execution of RemoteKrbRelay, a tool used for Kerberos relaying attacks. The rule identifies the tool based on its executable name or original filename and various command-line arguments that indicate different Kerberos relaying attack techniques such as relaying to SMB, LDAP for RBCD (Resource-Based Constrained Delegation), changing user passwords, or adding users to groups.
Detects the creation of a new user account on an ESXi system using the 'esxcli' command-line interface. This activity can be an indicator of an adversary establishing persistence or gaining unauthorized access to the hypervisor.
Detects potentially suspicious child processes spawned by the SSH daemon (sshd) that execute commands using 'bash -c' or 'sh -c' as the root user. This behavior is indicative of potential exploitation of CVE-2024-3094, a backdoor in the XZ Utils library.
Detects when a Kubernetes Rolebinding is created or modified.
Detects suspicious SQL query keywords that are often used during reconnaissance, data exfiltration, or destructive activities. This includes keywords like 'drop', 'truncate', 'dump', and 'select *', which can indicate attempts to manipulate database structures, extract sensitive information, or perform denial-of-service attacks.
Detects the execution of the 'esxcli' command with the 'vm' flag to retrieve information about installed virtual machines on an ESXi hypervisor. This activity can be part of discovery phase by adversaries targeting ESXi environments.
Detects the execution of the "esxcli" command with the "network" flag to retrieve information about the network configuration on an ESXi host. This activity can be indicative of an adversary performing discovery.
Detects denied certificate enrollment requests by Active Directory Certificate Services. This can occur due to issues such as incorrect permissions on the certificate template or invalid signatures. While the rule itself doesn't directly detect the installation of a root certificate (T1553.004), a denied request could be an indicator of an adversary attempting to enroll a certificate for malicious purposes, potentially as a precursor to establishing trust for adversary-controlled infrastructure or for code signing. The denial of such a request could be a valuable alert for suspicious activity related to certificate services.
Page 330 of 680