SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,602 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of the Cloudflared Quick Tunnel utility, which can be used by adversaries to establish tunnels for various services like HTTP, RDP, SSH, and SMB. This tool has been observed in use by threat groups, including Akira ransomware, to create ad-hoc tunnels that generate random subdomains on trycloudflare.com.
Detects the creation of a file with an ".rdp" extension by applications that are not typically expected to create such files, such as web browsers, email clients, and chat applications. This can indicate an attempt to deliver a malicious RDP file to a user, potentially leading to initial access or defense evasion.
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process with suspicious access masks. Adversaries often target LSASS to dump credentials for lateral movement or privilege escalation. The rule looks for specific access mask values in Windows Security Event IDs 4656 (handle requested) and 4663 (object access attempt) that are indicative of credential dumping activities, while filtering out known legitimate processes.
Detects file access requests to the Windows Sysvol Policies Share by processes that are not commonly expected to interact with these files. This could indicate an adversary attempting to discover or exploit Group Policy Preferences for credential access or other malicious purposes.
Detects the creation of named pipes with patterns characteristic of the EfsPotato privilege escalation tool. This tool exploits a vulnerability related to the Encrypting File System (EFS) service to achieve local privilege escalation by creating specific named pipes for inter-process communication.
This rule detects the execution of the 'cloudflared' binary when it has been renamed. It looks for specific command-line arguments associated with Cloudflare Tunnel operations ('tunnel cleanup', 'tunnel run', '-url tunnel') in conjunction with a list of known SHA256 hashes for legitimate cloudflared executables. The rule triggers if these conditions are met and the executable's name is NOT one of the known legitimate 'cloudflared.exe' names, indicating a potential attempt to disguise its execution.
This rule detects the creation of files with uncommon extensions within Microsoft Office application startup folders, specifically for Word and Excel. Adversaries often leverage these folders to establish persistence by placing malicious documents, templates, or add-ins that execute automatically when the respective Office application is launched. The rule filters out common and legitimate Office file extensions to reduce false positives.
This rule detects the execution of the `system_profiler` utility on macOS when specific data types are requested. These data types (SPApplicationsDataType, SPHardwareDataType, SPNetworkDataType, SPUSBDataType) have been observed in use by threat actors and malware for system information discovery and potentially for defense evasion by checking for virtualization software. The `system_profiler` command provides detailed hardware and software configuration information about the system.
This rule detects the execution of the 'cloudflared.exe' binary from any location other than the standard installation paths ('Program Files (x86)\cloudflared\' or 'Program Files\cloudflared\'). Adversaries often use portable versions of legitimate tools like Cloudflared for command and control (C2) or data exfiltration, executing them from non-standard directories to evade detection. This behavior is frequently observed in ransomware campaigns, such as those by Akira, where Cloudflared is leveraged to establish tunnels for malicious traffic.
This rule detects the execution of a PowerShell script that utilizes the "Send-MailMessage" cmdlet along with the "-Attachments" flag. This combination is a strong indicator of potential data exfiltration via email, where an adversary might be sending sensitive files as attachments through SMTP. The rule aims to identify attempts to steal data by exfiltrating it over an unencrypted network protocol, specifically SMTP, to an alternative network location.
Page 381 of 680