SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,518 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious error messages from the OpenSSH daemon that may indicate an attempted exploit or a fatal error during an SSH connection attempt. These errors could be triggered by malformed requests or unusual client behavior designed to uncover vulnerabilities or bypass authentication.
Detects Kerberos Ticket-Granting Service (TGS) requests that utilize RC4 encryption. This is often indicative of Kerberoasting attacks, where adversaries request service tickets for Service Principal Names (SPNs) and then attempt to crack the RC4-encrypted hash offline to obtain plaintext credentials. The rule specifically excludes requests from computer accounts (service accounts ending with '$') to reduce false positives.
This rule detects the creation or update of Active Directory Certificate Services (AD CS) certificate templates that include the 'CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT' flag. This flag allows a user to specify the subject name in a certificate request, which can be abused for privilege escalation or credential access, particularly in scenarios involving misconfigured AD CS environments as described in the 'Certified Pre-Owned' research.
This rule detects Mimikatz DCSync activity by monitoring Windows Security Event ID 4662. Specifically, it looks for access attempts to replicate directory changes (identified by specific GUIDs) with an AccessMask of '0x100'. To reduce false positives, it filters out activity from 'Window Manager' and service accounts starting with 'NT AUT', 'MSOL_', or ending with '$'.
This rule detects attempts to modify file time attributes using the 'touch' command on macOS. Adversaries may alter file timestamps to hide new or modified files, making them appear less suspicious to forensic investigators or automated tools. The rule specifically looks for the execution of the 'touch' command with common arguments used for timestomping, such as '-t' (specify time), '-acmr' (change access, modification, creation, and reference times), '-d' (specify date string), or '-r' (reference file).
This rule detects suspicious user agent strings commonly used by various hacking tools, including vulnerability scanners, brute-force tools, and SQL injection tools, within proxy logs. The rule identifies specific strings indicative of tools like Arachni, Hydra, DirBuster, SQLMap, and others, which are often employed during reconnaissance, initial access, and credential access phases of an attack.
Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452. The rule specifically looks for HTTP requests containing URI query strings indicative of the vulnerability, combined with a successful HTTP status code (200), suggesting a successful exploitation or at least a successful attempt to trigger the vulnerable endpoint.
Detects attempts to change file time attributes on Linux systems using the 'touch' command with specific flags, which can be used by adversaries to hide new or modified files by making their timestamps appear legitimate. This technique is often referred to as timestomping.
Detects exploitation attempts targeting Oracle WebLogic servers using the CVE-2020-14882 vulnerability. The rule specifically looks for URI query patterns indicative of directory traversal attempts used in the exploit.
This rule detects attempts to exploit the ProxyLogon vulnerability (CVE-2021-26858) against Microsoft Exchange Server. Specifically, it looks for POST requests to '/ecp/DDI/DDIService.svc/SetObject' with query parameters indicating a 'schema=Reset' and 'VirtualDirectory' operation, combined with a username ending in '$', which is characteristic of the Server-Side Request Forgery (SSRF) phase of the attack used to manipulate virtual directories.
Page 403 of 680