SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,520 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects suspicious DNS queries that are characteristic of Cobalt Strike beacons. Specifically, it looks for DNS queries starting with 'aaa.stage.' or 'post.1', or containing '.stage.123456.'. These patterns are known indicators of Cobalt Strike's DNS command and control (C2) communication.
This rule detects the creation or modification of specific file types (.wll, .xll, .xlam, .xla, .ppam) in Microsoft Office startup or add-in directories. These files can be used to establish persistence by executing malicious code when Microsoft Office applications (Word, Excel, PowerPoint) are launched. The rule specifically targets paths associated with Word Startup, Excel Startup, Excel XLSTART, and generic Microsoft Addins folders.
Detects remote printer driver load from a Detailed File Share event in Windows Security logs, which is indicative of successful exploitation attempts against the Print Spooler vulnerabilities CVE-2021-1675 (PrintNightmare) and CVE-2021-34527.
Detects PowerShell scripts that modify the Access Control List (ACL) of a file or folder using the `Set-Acl` cmdlet. This activity can be indicative of an adversary attempting to change permissions to gain unauthorized access, elevate privileges, or maintain persistence.
This rule detects the execution of common network sniffing tools, specifically 'tcpdump' or 'tshark', when they are invoked with arguments indicating an attempt to capture network traffic from a specific interface. The rule looks for the '-c' argument (for count) and the '-i' argument (for interface) in the command line, which are typical indicators of active network sniffing.
Detects suspicious shell commands commonly used in various exploit codes, including those associated with Apache Struts vulnerabilities and Metasploit framework activities. The rule looks for patterns indicative of downloading and executing scripts, setting up reverse shells, or modifying file permissions for persistence or privilege escalation.
Detects the creation of hidden user accounts on macOS. This can occur either by assigning a UserID less than 500 or by explicitly setting the 'IsHidden' option to true during account creation using the 'dscl' command-line utility.
This rule detects when an Azure AD user's credentials have been identified as leaked. This detection is based on the 'leakedCredentials' risk event type reported by Azure AD Identity Protection, indicating that the user's valid credentials (e.g., username and password) have been found on the dark web or other publicly available sources.
Detects when Microsoft Cloud App Security reports that an OAuth application has downloaded multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user. This activity could indicate unauthorized data exfiltration by a compromised or malicious OAuth app.
Detects suspicious and malformed user agent strings in proxy logs that may indicate malicious activity, including the use of specific malware or tools like Cobalt Strike, APT28 malware, Racoon Stealer, and Erbium stealer. The rule identifies various anomalies such as incorrect formatting, typos, and specific user agent strings known to be associated with adversary tools.
Page 404 of 680