SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,605 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host
Detects the creation of a file named "wermgr.exe" in an uncommon directory, which could indicate exploitation of CVE-2023-36874. The rule specifically looks for 'wermgr.exe' being created outside of standard Windows system directories, aiming to catch malicious instances masquerading as the legitimate Windows Error Reporting Manager.
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Detects exploitation indicators of CVE-2022-42475, a heap-based buffer overflow vulnerability in FortiOS SSL-VPN's sslvpnd daemon. The rule specifically looks for the creation of known malicious files or configuration backups in specific directories, which are artifacts of successful exploitation.
Detects exploitation attempts of CVE-2024-49113, known as LDAP Nightmare. This rule specifically looks for "Application Error" events (EventID 1000) where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll". This combination indicates a crash in the Local Security Authority Subsystem Service (LSASS) related to the Windows Lightweight Directory Access Protocol (LDAP) client library, which is consistent with the described vulnerability exploitation.
Detects modifications to shell context menu commands within the Windows Registry. This rule is designed to identify potential persistence mechanisms or suspicious activity where an attacker might alter the commands executed when a user interacts with files or folders via the right-click context menu. The detection specifically looks for changes in registry paths containing '\Software\Classes\', '\shell\', and '\command\', which are indicative of context menu command definitions.
Detects remote binary or command execution via the ScreenConnect Service. This rule is intended for hunting anomalous executions originating from ScreenConnect, which is a legitimate remote administration tool that can be abused by threat actors.
Detects the execution of the Evil-WinRM hack tool by identifying specific hardcoded strings within PowerShell Module logs. This rule looks for patterns associated with Evil-WinRM's functionality, such as specific PowerShell commands for file operations, binary invocation, and registry queries, executed within the context of wsmprovhost.exe.
Detects DNS queries for specific command and control (C2) domains known to be used by DPRK (Democratic People's Republic of Korea) threat actors. The rule specifically looks for 'connection.lockscreen.kro.kr' and 'updating.dothome.co.kr' in DNS query names.
Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Page 366 of 680