SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,608 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects access to the 'wceaux.dll' file, which is associated with the Windows Credential Editor (WCE) tool. This activity is indicative of an attempt to perform pass-the-hash remote command execution, often used for credential dumping and lateral movement. The rule specifically looks for Security Event IDs 4656 (A handle to an object was requested) or 4663 (An attempt was made to access an object) where the accessed object's name ends with '\wceaux.dll'.
Detects exploitation activity of CVE-2023-46747, an unauthenticated remote code execution vulnerability in F5 BIG-IP. The rule looks for specific POST requests to '/mgmt/tm/util/bash' containing keywords related to form submission and user creation within the F5 BIG-IP Traffic Management User Interface (TMUI).
Detects potential exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The rule specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' that result in a 200 HTTP status code, indicating a successful attempt to access this specific endpoint which is part of the vulnerability exploitation chain.
Detects exploitation activity targeting CVE-2023-46747, an unauthenticated remote code execution vulnerability in F5 BIG-IP. The rule specifically looks for POST requests to '/mgmt/tm/util/bash' containing hex-encoded or plain text strings related to '/tmui/Control/form' and 'form_page=%2ftmui%2fsystem%2fuser%2fcreate.jsp', which are indicators of the exploit attempting to create a new user.
Detects potential exploitation attempt of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability, via proxy logs. This vulnerability allows for the disclosure of sensitive information, such as session tokens.
Detects code integrity failures such as missing page hashes or corrupted drivers due to unauthorized modification. This could be a sign of tampered binaries, which adversaries might use for defense evasion or to maintain persistence.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center / Confluence Server. This vulnerability allows an attacker to create admin accounts and execute arbitrary commands. The rule specifically looks for suspicious child processes like bash, curl, or wget being spawned by the Confluence Java process.
Detects exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The rule specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' with an unusually long 'cs-host' header string, which is characteristic of the exploit.
This rule detects file modifications to ASPX and ASHX files within the root of the 'App_Extensions' directory by the 'ScreenConnect.Service.exe' process. This activity is indicative of exploitation of CVE-2024-1708, a ZipSlip vulnerability in ConnectWise ScreenConnect versions prior to 23.9.8, which allows for path traversal and arbitrary file write.
This rule detects the creation of specific configuration files (`.conf`) in the `AppData\Roaming` directory, which have been observed in the wild to be associated with Remote Access Trojans (RATs) such as VenomRAT, AsyncRAT, and Lumma Stealer. The rule looks for files ending with `datalogs.conf`, `hvnc.conf`, or `dcrat.conf` within subdirectories like `mydata`, `datalogs`, `hvnc`, or `dcrat` under `AppData\Roaming`.
Page 361 of 680