SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,612 copies16 likes160,613 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the execution of 'rundll32.exe' with command-line arguments that suggest an obfuscated ordinal call. Ordinal calls are a way to execute functions within a DLL by their numerical index rather than their name. Adversaries may obfuscate these ordinal numbers by adding leading zeros or using large numbers that wrap around due to 16-bit integer limitations, making the command line harder to analyze and potentially bypassing signature-based detections.
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File System (CLFS) driver vulnerabilities. The rule identifies processes loading 'clfs.sys' from common temporary or user-writable directories often abused by malware or exploits.
Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used.
This may indicate an attacker attempting to leverage credentials they have obtained.
This may indicate an attacker attempting to leverage credentials they have obtained.
Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.
Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity.
Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet). The rule specifically looks for connections to Google API domains from processes that are not common web browsers or Google-related applications, aiming to identify potentially malicious command and control activity.
Detects suspicious encoded character syntax often used for defense evasion
Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks.
It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.
It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.
Detects the installation of the anydesk software service. Which could be an indication of anydesk abuse if you the software isn't already used.
Detects the execution of AADInternals PowerShell cmdlets. AADInternals is a tool used for administering Azure AD and Office 365, which can be abused by threat actors for various attacks including reconnaissance, credential access, and impact within Azure AD or Office 365 environments. The rule specifically looks for the unique "-AADInt" string prefix in cmdlet names.
Page 355 of 680