SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,602 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects a Python process attempting to spawn a pseudo-terminal (TTY) using the `pty` module. This behavior is often indicative of an attacker establishing a reverse shell for interactive command execution on a compromised system. The rule specifically looks for Python executables and command-line arguments that import the `pty` module and call its `spawn` function.
Detects a highly relevant Antivirus alert that reports a password dumper. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects the execution of Python code that imports the 'pty' and 'socket' modules and uses 'spawn' and '.connect' functions, which is a common pattern for establishing a reverse shell.
Detects suspicious DNS queries to known Monero mining pools, indicating potential cryptocurrency mining activity on the network. This rule identifies specific domain names associated with various Monero mining operations.
Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information. This tool is used by adversaries to impair defenses.
Detects potential exploitation attempts of the Netlogon Elevation of Privilege Vulnerability (CVE-2020-1472), also known as Zerologon. This rule specifically looks for Event ID 4742 (A computer account was changed) where the SubjectUserName is 'ANONYMOUS LOGON' and the TargetUserName matches a Domain Controller's machine account name (ending with '$'), while filtering out legitimate password changes by checking if 'PasswordLastSet' is not '-'.
Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms.
Detects the execution of the "cloudflared" tool with command-line arguments indicative of establishing or running a tunnel. This activity has been observed in post-compromise scenarios by threat actors, such as the Akira ransomware group, to maintain persistence and remote access to compromised networks by creating covert communication channels.
Detects the use of 'tail' to extract bytes at an offset from an image file (e.g., JPEG, PNG) and then pipe the output to 'base64 --decode' to create a new file with the decoded content. This technique is often used by adversaries to deobfuscate or extract hidden payloads from seemingly innocuous image files, typically executed as a bash one-liner.
Page 380 of 680