SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,517 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects uncommon or suspicious child processes spawning from a Windows Subsystem for Linux (WSL) process. This behavior can indicate an attempt to evade parent/child relationship detections, or persistence attempts using cron within WSL. The rule specifically looks for common Windows LOLBINs (Living Off the Land Binaries) or processes launched from suspicious temporary or user-controlled directories, originating from wsl.exe or wslhost.exe.
Detects attempts to exploit the Grafana path traversal vulnerability (CVE-2021-43798) by looking for specific path traversal sequences combined with requests to known Grafana plugin directories that result in a successful HTTP status code (200).
Detects the execution of 'net.exe' or 'net1.exe' with command-line arguments commonly used for discovery activities related to accounts, groups, shares, and services. This rule aims to identify potential reconnaissance or privilege escalation attempts.
Detects when Google Cloud Storage buckets are enumerated. This activity involves listing storage buckets or their channels, which can be an indicator of reconnaissance by an attacker attempting to understand the environment's data storage landscape.
Detects when an application is removed from Google Workspace, which could indicate an attempt to disrupt services or remove security controls. This includes both direct application removal and removal from a whitelist.
This rule detects command-line operations that target common shell history files on Linux systems. Adversaries often manipulate or delete these files to remove traces of their activities or to extract sensitive information like credentials that might have been typed into the command line. The rule specifically looks for execution events (`EXECVE`) that involve files such as `.bash_history`, `.zsh_history`, `.zhistory`, `.history`, `.sh_history`, and `fish_history`.
This rule detects attempts to delete history files, such as bash_history or zsh_history, on Linux systems. Adversaries often delete these files to remove traces of their activities and hinder forensic analysis. The rule specifically looks for process creation events where commands like 'rm', 'unlink', or 'shred' are used with command-line arguments indicating history files.
Detects potential token impersonation and theft on Windows systems. This rule specifically looks for successful logon events (EventID 4624) with a LogonType of 9 (NewCredentials), where the LogonProcessName is 'Advapi' and the AuthenticationPackageName is 'Negotiate', combined with an ImpersonationLevel indicating impersonation. This combination of events is indicative of an attempt to duplicate and impersonate an existing access token, often used for privilege escalation or defense evasion.
This rule detects RDP traffic communicating with the loopback address (127.0.0.1 or ::1) on either the source or destination port 3389, specifically looking for Windows Filtering Platform (WFP) events (EventID 5156). This behavior is indicative of RDP over a reverse SSH tunnel, where RDP traffic is redirected locally to bypass network restrictions or for covert communication. The rule explicitly filters out events originating from 'AppContainer Loopback' and known Thor processes to reduce false positives.
This rule detects the use of potentially suspicious keywords within PowerShell scripts that are often associated with exploitation frameworks or advanced attack techniques. Specifically, it looks for reflection-related keywords like 'System.Reflection.Assembly.Load', '[System.Reflection.Assembly]::Load', '[Reflection.Assembly]::Load', 'System.Reflection.AssemblyName', 'Reflection.Emit.AssemblyBuilderAccess', 'Reflection.Emit.CustomAttributeBuilder', and keywords related to interop services and process manipulation such as 'Runtime.InteropServices.UnmanagedType', 'Runtime.InteropServices.DllImportAttribute', 'SuspendThread', and 'rundll32'. These keywords can indicate attempts to load assemblies in-memory, interact with unmanaged code, or manipulate processes, which are common tactics used by malware and red teaming tools.
Page 410 of 680