SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,609 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects instances where a VNC service on an OpenCanary node has had a connection attempt. This indicates an adversary attempting to connect to a VNC service, likely for remote access or reconnaissance.
Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values to disable the showing of hidden files and system files. This technique is often abused by malware to hide its files from users.
Detects the execution of a Word document via the WinWord Start Menu shortcut using `cmd.exe`. This behavior has been observed in KamiKakaBot samples to initiate the second stage of infection. The rule specifically looks for `cmd.exe` executing a command line that includes a `.lnk` file, a path containing `Start Menu\Programs\Word`, and a `.doc` file extension.
This rule detects when an OpenCanary honeypot's NTP service receives a 'monlist' request. The 'monlist' command is a deprecated feature in NTP that can be abused for amplification attacks (Network Denial of Service). Detecting this activity on a honeypot indicates an adversary is likely scanning for vulnerable NTP servers or attempting to use the honeypot in an amplification attack.
Detects the creation of a scheduled task that runs weekly and executes the "shutdown /l /f" command. This behavior has been observed being used by KamiKakaBot samples to achieve persistence on a system.
Detects a network connection that was initiated from a PowerShell process. Malicious PowerShell scripts often download additional payloads or communicate back to command and control channels via uncommon ports or IPs. This rule can be used as a basis for hunting for anomalies.
This rule detects the execution of rundll32.exe with a command line that does not specify a common DLL extension (.cpl, .dll, .inf). Adversaries often use rundll32.exe to execute malicious code, and by using uncommon or no extensions, they attempt to evade detection mechanisms that might look for standard rundll32.exe usage. The rule filters out known legitimate uses of rundll32.exe, such as those involving common extensions, local server invocations, MSIExec processes, and specific Microsoft EdgeUpdate processes.
This rule detects when an OpenCanary honeypot receives a Session Initiation Protocol (SIP) request. OpenCanary is a honeypot designed to detect unauthorized activity by mimicking vulnerable services. A SIP request to an OpenCanary node indicates that an attacker or scanner has interacted with the emulated SIP service, which is typically an indicator of reconnaissance or an attempted attack against voice-over-IP (VoIP) infrastructure.
Detects tampering with the "Enabled" registry key to disable Windows event logging for a specific event channel. This activity is often performed by adversaries to evade detection by security tools and analysts.
This rule detects when the Windows Defender service (WinDefend) is disabled by modifying its 'Start' registry key. This is a common technique used by attackers or malware to impair defenses and avoid detection.
Page 359 of 680