SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,601 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects network connections initiated by executables (excluding common internet browsers and known applications) to a list of legitimate, popular websites that have been previously identified as 'dead drop resolvers' in cyberattacks. Attackers leverage these trusted websites (e.g., Facebook, YouTube, Google Drive) to host C2 infrastructure or relay data, aiming to blend in with normal network traffic and evade detection. The rule specifically filters out connections from a comprehensive list of legitimate browser executables and other applications to reduce false positives.
Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains. This behavior can indicate data exfiltration or the staging of malicious tools.
Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.
Detects the execution of python with calls to the socket and pty module in order to connect and spawn a potential reverse shell.
Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.
Detects potential calls to NtOpenProcess directly from NTDLL.
Detects execution of "tar.exe" in order to create a compressed file.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration.
Detects execution of "tar.exe" in order to extract compressed file.
Adversaries may abuse various utilities in order to decompress data to avoid detection.
Adversaries may abuse various utilities in order to decompress data to avoid detection.
Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key.
This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.
This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.
Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.
Page 384 of 680