SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,603 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent
Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.
Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine
Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same
Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120
Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.
Detects the use of IOX - a tool for port forwarding and intranet proxy purposes
Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.
Detects highly relevant antivirus alerts indicating the presence of hack tools or other attack tools. This rule emphasizes that even if the antivirus blocks the malware, the event requires investigation to understand how the tool initially compromised the system.
This rule detects highly relevant antivirus alerts that specifically report the presence of a web shell. It is designed to flag antivirus detections where the signature indicates a web shell, often identified by keywords related to common web scripting languages (ASP, PHP, JSP, Perl) and terms like 'Backdoor', 'Webshell', or specific web shell names (C99shell, Chopper). The rule emphasizes that such alerts, even if the malware is blocked, warrant further investigation into how the web shell was initially placed on the system.
Page 379 of 680