SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,547 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of a file named "code_tunnel.json" when the creating process is not a legitimate Visual Studio Code executable. This indicates potential execution and usage of the VsCode tunneling utility by an unauthorized or renamed process, which could be used for command and control.
Detects the creation of a local user account named "DarkGate" with the username "SafeMode" using the `net.exe` or `net1.exe` command-line utility. This specific pattern is associated with DarkGate malware activity.
Detects the redirection of discovery command output by the Ursnif malware. Specifically, it looks for `cmd.exe` processes spawned by `explorer.exe` that execute a command with `/C ` and redirect its output to a `.bin` file in the `AppData\local\temp\` directory.
Detects the creation of specific files in the ProgramData directory, which are known indicators of compromise associated with the Diamond Sleet APT group. These files include executables, DLLs, and other data files used in their attack campaigns.
Detects the creation of a specific file, 'inetmgr.exe', in the 'C:\Windows\ADFS\bg\' directory. This activity has been linked to the Onyx Sleet (also known as Andariel) APT group, particularly in the context of exploiting the TeamCity CVE-2023-42793 vulnerability.
Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects access to the Okta password health report endpoint, which should only be accessed via the Okta Admin Console UI. This rule is intended for threat hunting to identify suspicious requests, especially when correlated with the absence of a corresponding admin console login. This activity was highlighted in the context of the Okta support incident in October 2023.
Detects the execution of "csc.exe" by the "w3wp.exe" process, specifically looking for patterns indicative of the MOVEit Transfer CVE-2023-34362 exploitation. This activity is associated with dynamic compilation of malicious DLL files within the .NET framework temporary ASP.NET files directory.
Detects exploitation attempts of CVE-2023-43261, an information disclosure vulnerability in Milesight UR5X, UR32L, UR32, UR35, UR41 routers before v35.3.0.7. Attackers can access sensitive router components, specifically the 'httpd.log' file, through proxy logs. This rule looks for GET requests to the '/lang/log/httpd.log' path with a successful HTTP status code (200).
Detects exploitation attempts of CVE-2023-43261, an information disclosure vulnerability in Milesight UR5X, UR32L, UR32, UR35, UR41 routers before v35.3.0.7. This vulnerability allows attackers to access sensitive router components by requesting the '/lang/log/httpd.log' file, which can contain passwords and other critical information.
Page 395 of 680