SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,608 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center / Confluence Server, where an attacker can exploit vulnerable endpoints to create admin accounts and execute arbitrary commands. Specifically, this rule looks for suspicious child processes like cmd.exe or powershell.exe being spawned by Tomcat processes associated with Confluence.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center and Confluence Server. This vulnerability allows an attacker to exploit specific endpoints to potentially create administrator accounts and execute arbitrary commands. The rule identifies POST requests to known vulnerable URIs associated with setup and restore actions, or server information, which are indicative of an exploitation attempt.
Detects exploitation attempts of CVE-2023-46214, a remote code execution (RCE) vulnerability in Splunk Enterprise. The rule specifically looks for patterns associated with known public proof-of-concept (POC) code that leverages insecure XML parsing. It identifies POST requests to specific Splunk API endpoints (`/splunkd/__upload/indexing/preview` or `/api/search/jobs/results`) with particular URI query parameters (`NO_BINARY_CHECK=1`, `input.path=shell.xsl`, `/opt/splunk/var/run/splunk/dispatch/`, `/shell.xsl`) that indicate an attempt to upload and execute a malicious XSL stylesheet.
Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity. The rule looks for rundll32.exe being spawned by common scripting or execution processes (cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, wscript.exe) and executing a file in common temporary or user-writable directories (ProgramData, Users\Public, Windows\Installer, AppData\Local\Temp, AppData\Roaming) where the file being executed does not have a standard DLL, CPL, or INF extension.
This rule detects the creation, modification, or deletion of scheduled tasks with specific names known to be used by the SVR-affiliated GraphicalProton backdoor. The rule monitors Windows Security Event IDs 4698 (A scheduled task was created), 4699 (A scheduled task was deleted), and 4702 (A scheduled task was updated) for a predefined list of suspicious task names.
This rule detects file modifications to the temporary XML user database file within the ScreenConnect server. Such modifications can indicate local user changes, which may occur during the exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions prior to 23.9.8. Legitimate modifications to local users or permissions within ScreenConnect can also trigger this detection. This rule requires Advanced Auditing to log successful Windows Event ID 4663 events and a System Access Control List (SACL) set on the relevant ScreenConnect directory.
Detects the execution of a Control Panel (.CPL) file located in the user's temporary directory via the Shell32 DLL's "Control_RunDLL" export function. This behavior has been observed in multiple Raspberry Robin malware variants.
Detects exploitation attempts of CVE-2023-22518, an improper authorization vulnerability in Confluence Data Center and Server. Attackers can exploit vulnerable endpoints to create admin accounts or execute arbitrary commands. The rule specifically looks for POST requests to known vulnerable URIs associated with setup and restore functionalities.
Detects GET requests to specific files ('/human2.aspx' or '/_human2.aspx') that are known indicators of exploitation attempts targeting the MOVEit Transfer vulnerability CVE-2023-34362. These requests are typically associated with web shell deployment or interaction after initial compromise.
Detects potential exploitation attempts of an undocumented Windows Server pre-authentication Remote Code Execution (RCE) vulnerability. The rule specifically looks for a new 'svchost.exe' process being created by another 'svchost.exe' process, both running with the '-k DHCPServer' command line argument, and under a Network Service account (covering multiple language settings). This pattern indicates an unusual execution flow that could be indicative of an RCE exploit targeting the DHCP Server service.
Page 363 of 680