SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,518 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects attempts to access the hidden administrative network share 'ADMIN$' on Windows systems. The 'ADMIN$' share is a default hidden share that maps to the Windows directory (usually C:\Windows) and is primarily used for remote administration. Adversaries often leverage these administrative shares for lateral movement, file transfer, and remote execution within a compromised network. The rule specifically looks for Event ID 5140, which indicates a network share object was accessed, and filters for the 'Admin$' ShareName. It also filters out access from computer accounts (ending with '$') to reduce false positives from legitimate system activities.
Detects suspicious access to Microsoft Teams application's authentication tokens and local storage, which may contain sensitive credentials. This rule specifically looks for Event ID 4663 (Object Access) where the accessed object path contains '\Microsoft\Teams\Cookies' or '\Microsoft\Teams\Local Storage\leveldb', and the accessing process is NOT the legitimate 'Teams.exe'. This indicates an attempt by an unauthorized process to steal Teams authentication tokens.
This rule detects the installation and execution of the PsExec service (PSEXESVC) on Windows systems. It specifically looks for Event ID 7045 from the 'Service Control Manager' provider, which indicates a service installation event. The rule then checks if the installed service's name is 'PSEXESVC' or if its image path ends with '\PSEXESVC.exe'. This is a common indicator of PsExec being used for remote execution.
This rule detects the execution of `iptables` commands that configure TCP port redirection, specifically looking for the `--to-ports 42` or `--to-ports 43` arguments. This behavior is associated with the BPFDoor malware, which uses iptables to redirect incoming traffic on a specific port (e.g., SSH port 22) to a different, often higher, port where its shell is listening, effectively bypassing firewall rules for the attacker's host.
Clear Linux Logs
Sigma
Detects attempts to clear logs on the system by identifying command-line executions of 'rm', 'shred', or 'unlink' targeting common log directories like '/var/log' and '/var/spool/mail'. Adversaries may clear system logs to hide evidence of an intrusion.
Detects scenarios where a potentially unauthorized application or user modifies the system time. This can be an indicator of defense evasion or an attempt to disrupt system operations or forensic analysis.
Detects lateral movement activity using various Impacket tools such as wmiexec, dcomexec, atexec, and smbexec. The rule identifies specific parent processes and command-line arguments indicative of these tools, which often involve `cmd.exe` executing commands with output redirection to a local loopback address.
This rule detects suspicious DNS queries where the Z flag bit in the DNS protocol header is set to a non-zero value. The Z flag is reserved (unused) per IETF design, though it has recently been used in DNSSec. A non-zero Z flag value should be rare outside of legitimate DNSSec usage. The rule includes exclusions for common TLDs, query types (NS, MX), responses, and NetBIOS related traffic to reduce false positives. The rule's intent is to identify potential command and control (C2) or data exfiltration attempts leveraging DNS anomalies.
Detects the installation of services that are characteristic of Metasploit's SMB PsExec module (exploit/windows/smb/psexec) and Impacket's psexec.py. The rule specifically looks for Windows Security Event ID 4697 (A service was installed in the system) where the ServiceFileName matches a pattern of '%systemroot%\<8_random_chars>.exe' and the ServiceName matches a pattern of 4, 8, or 16 alphabetic characters, while excluding the known legitimate 'PSEXESVC' service.
This rule detects PowerShell script block text that attempts to modify file timestamps (creation, last write, or last access times). This technique, known as timestomping, is often used by adversaries to hide new or modified files by making them appear to have older timestamps, blending them with legitimate files on the system.
Page 405 of 680