SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,603 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.
Detects the execution of Fast Reverse Proxy (FRP) client or server binaries, or command-line arguments indicative of FRP configuration files. FRP is a legitimate tool that can be used by adversaries to establish command and control (C2) channels by exposing local services behind NAT or firewalls to the internet, effectively creating a proxy.
Detects the execution of PAExec, a legitimate remote administration tool, when its executable name has been changed from the default 'PAExec.exe'. Adversaries often rename legitimate tools like PAExec to evade detection by security products that might flag the original executable name. The rule identifies PAExec based on its internal metadata (Description, OriginalFileName, Product) or specific IMPHASH values, and then filters out instances where the executable retains its original name or is executed from a known PAExec-specific directory created by the tool itself (e.g., C:\Windows\PAExec-XXXXX-ComputerName). This helps to focus on suspicious renamed executions.
This rule detects the creation of a named file stream (Alternate Data Stream - ADS) containing specific Imphash values associated with known hack tools. The Imphash values are for tools such as Mimikatz, PetitPotam, JuicyPotato, RoguePotato, Pwdump, Cobalt Strike beacons, NanoDump, HandleKatz, DripLoader, UACMe, Dumpert, EDRSandBlast, and others. Adversaries often use ADSs to hide malicious executables or data to evade detection by traditional security tools that may not scan alternate data streams.
Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.
Detects the loading of 'EvtMuteHook.dll' based on its unique IMPHASH. This DLL is a component of SharpEvtHook/EvtMute, a tool designed to tamper with Windows event logs to evade detection. The rule specifically looks for the known IMPHASH of this malicious DLL.
This rule detects the creation of processes with specific SHA1 or SHA256 hashes that have been identified as indicators of compromise (IOCs) associated with the GALLIUM cyber espionage group. These hashes correspond to known malicious executables used by the group. The detection is based on a report by Microsoft Threat Intelligence Center from December 2019, which detailed GALLIUM's targeting of global telecommunications.
Detects the loading of specific malicious DLLs (ffmpeg.dll, d3dcompiler_47.dll, and an ICONIC Stealer payload) that were identified as compromised and used in attacks involving the 3CXDesktopApp. This rule uses SHA256, SHA1, and MD5 hashes to identify the malicious DLLs.
Detects when an access policy that is applied to a GCP cloud resource is deleted.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
Detects the execution of Process Hacker, a tool used to view and manipulate processes and other low-level system options. Detection is based on binary metadata such as image path, original filename, description, product name, and known file hashes (MD5, SHA1, SHA256, IMPHASH). Threat actors have been known to abuse older, vulnerable versions of Process Hacker to manipulate system processes.
Page 375 of 680