SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,608 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects indicators of exploitation by threat actors during exploitation of the "SlashAndGrab" vulnerability related to ScreenConnect (ConnectWise) as reported by Team Huntress. This rule specifically looks for the creation of known malicious files and paths associated with post-exploitation activities after successful exploitation of CVE-2024-1709 and CVE-2024-1708.
Detects instances where an HTTP service on an OpenCanary node has received a GET request.
Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Detects instances where an SNMP service on an OpenCanary node has had an OID request.
Detects suspicious user agent strings commonly used by exploit and penetration testing frameworks such as Metasploit, Cobalt Strike, Empire, and Havoc. These user agents often mimic legitimate browsers or applications but contain specific patterns that indicate their use by these tools. The rule is designed to identify command and control (C2) communication or initial access attempts originating from these frameworks by analyzing proxy logs.
Detects instances where a GIT service on an OpenCanary node has had Git Clone request.
Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.
Page 364 of 680