SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,608 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe
Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.
Detects the execution of an AnyDesk binary with a version prior to 8.0.8.
Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors.
Use this rule to detect instances of older versions of Anydesk using the compromised certificate
This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.
Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors.
Use this rule to detect instances of older versions of Anydesk using the compromised certificate
This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.
Detects the execution of a system command via the ScreenConnect RMM service.
Detects the potential use of Rubeus by identifying the registration of a new trusted logon process. This activity is often associated with Kerberos-related attacks, where Rubeus is used to manipulate Kerberos tickets or processes for privilege escalation or lateral movement.
Detection rule generated by AI system
This rule detects potential secure deletion activity using SDelete by monitoring Windows Security Event IDs 4656, 4663, and 4658 for file objects ending with '.AAA' or '.ZZZ'. These extensions are commonly associated with SDelete's file wiping process, where it renames files with these extensions during secure deletion to prevent recovery.
Detects the execution of command-line utilities such as 'kill', 'pkill', 'killall', or 'xkill' to terminate or send signals to running processes on a Linux system. This activity can be indicative of an adversary attempting to disrupt services, evade defenses, or clean up their tracks.
Detects enumeration of local system accounts on Linux. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. The rule identifies common commands and file accesses used for this purpose, such as 'lastlog', 'id', 'lsof -u', and utilities like 'cat', 'head', 'tail' accessing '/etc/passwd', '/etc/shadow', or '/etc/sudoers'.
Detects PowerShell execution that utilizes the bitwise XOR (bxor) operator. Attackers may use this as an alternative obfuscation method to Base64 encoded commands to evade detection. Investigation of the command line and process tree is recommended to determine if the activity is malicious.
Page 368 of 680