SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,567 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects potential initial exploitation attempts against VMware Horizon deployments running a vulnerable version of Log4j (CVE-2021-44228). Specifically, this rule looks for process creation events where the parent process is 'ws_TomcatService.exe' and the created process is NOT 'cmd.exe' or 'powershell.exe'. This aims to catch unexpected executables launched by the vulnerable Tomcat service as a result of successful Log4j exploitation.
This rule detects the creation of a file named "code_tunnel.json". This file is associated with the execution and usage of the Visual Studio Code (VSCode) tunneling utility. Adversaries can abuse this functionality to establish a command and control (C2) channel, allowing them to remotely control compromised systems.
Detects command execution events originating from ScreenConnect, a legitimate remote administration tool. This rule specifically looks for Windows application log events where ScreenConnect is the provider and an event ID of 200 indicates a command of a certain length was executed. This activity can be indicative of an attacker using ScreenConnect for malicious purposes, such as executing arbitrary commands on a compromised system.
Detects the creation of files by the "node.exe" process within the ".vscode-server" directory, specifically targeting paths related to user history. This activity could indicate remote file creation via the Visual Studio Code tunnel feature, which might be used for unauthorized access or data transfer.
Detects the creation of files with a double extension where the second extension is ".lnk" and the first extension is commonly associated with documents or images. This technique is often used by malware to masquerade malicious LNK files as benign documents or images, exploiting the default Windows behavior of hiding known file extensions.
Detects potential exploitation attempts of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager. The rule specifically looks for PowerShell or cmd.exe processes being spawned as child processes of the legitimate Tomcat "prunsrv.exe" process, which was observed as part of the attack chain by Morphisec.
Detects when AWS S3 bucket versioning is disabled. This action can be a precursor to data deletion or modification without the ability to recover previous versions, often seen in ransomware attacks targeting cloud storage.
This rule detects the creation or activation of new user accounts in Okta with specific display names, such as 'svc_network_backup', which were identified as indicators of compromise during the Okta Support System 2023 breach. It aims to flag suspicious account activity that could indicate unauthorized access or persistence by an attacker. The rule can be improved by filtering out legitimate usernames if 'svc_network_backup' is a known and authorized account in the environment.
This rule detects exploitation indicators for CVE-2023-20198, a privilege escalation vulnerability in Cisco IOS XE Software Web UI. It looks for specific log messages related to Web UI installation operations, system configuration changes, or successful web logins, in conjunction with the use of specific user accounts ('cisco_tac_admin', 'cisco_support', 'cisco_sys_manager') that are not typically created by default or used by Cisco representatives. The combination of these events suggests an attempt to exploit the vulnerability.
Detects the creation of an HTA file in the Windows Startup folder by FoxitPDFReader. This activity is indicative of potential exploitation of CVE-2023-27363, a vulnerability in Foxit Reader that could allow an attacker to achieve persistence by placing a malicious HTA file in a location that executes upon user login.
Page 393 of 680