SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,618 copies16 likes160,617 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of the `nscurl` utility on macOS with command-line arguments indicative of file download operations. This can be used by adversaries to transfer tools or other files into a compromised environment.
This rule detects the execution of the 'sysctl' command on macOS with specific arguments ('hw.', 'kern.', or 'machdep.'). Threat actors and malware commonly use 'sysctl' with these arguments to gather system hardware information, often as part of virtualization or sandbox evasion techniques. By querying system properties, adversaries can determine if they are operating in an analysis environment and adjust their behavior accordingly.
Detects when the Time Machine backup utility is disabled on macOS using the `tmutil` command-line tool. This action can be performed by an attacker to prevent system backups, hindering recovery efforts after an attack.
Detects the execution of PowerShell scripts that use the 'Start-NetEventSession' cmdlet to initiate network event and packet capture. This activity can be leveraged by adversaries to sniff network traffic, potentially capturing sensitive information like user credentials, especially when transmitted over unencrypted protocols. This technique is often used for information gathering during an operation.
This rule detects attempts to delete macOS Time Machine backups using the native utility "tmutil" with the 'delete' command. Adversaries may perform this action to prevent victims from restoring their files, often as a precursor to a ransomware attack or other data destruction activities.
Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule". This activity is often associated with defense evasion tactics to allow adversary communications or lateral movement.
Detects an RDP connection originating from a domain controller. This activity is highly suspicious as domain controllers should not typically initiate RDP connections to other machines. Such an event could indicate lateral movement by an attacker who has compromised the domain controller. The rule specifically filters out connections made by "Microsoft.Tri.Sensor.exe", which is associated with Microsoft Defender for Identity, to avoid false positives from legitimate security operations.
Detects the creation of files with scripting or executable extensions by the MySQL daemon process. This activity could indicate the abuse of MySQL User Defined Functions (UDFs) to download and execute malware, often as part of a broader compromise or to establish persistence.
Detects network communication initiated to the 'portmap.io' domain. This domain is often associated with port forwarding services that can be abused by malicious actors for command and control (C2) communication or data exfiltration, potentially masking the true destination of the traffic.
Detects when a PowerShell script uses the 'New-NetFirewallRule' cmdlet to create a new firewall rule with an 'Allow' action. This activity can indicate an adversary attempting to bypass host-based firewalls to enable command and control, lateral movement, or data exfiltration.
Page 347 of 680