SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,517 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects suspicious command-line parameters commonly used by the Empire post-exploitation framework when launching PowerShell. Specifically, it looks for combinations of parameters such as '-NoP', '-sta', '-NonI', '-W Hidden', '-Enc', '-noP', '-w 1', '-enc', '-enc SQB', '-nop', '-exec bypass', and '-EncodedCommand'. These parameters are often used to execute encoded PowerShell scripts in a hidden or non-interactive manner, which is a common tactic for malicious PowerShell execution.
Detects suspicious PowerShell invocation command parameters indicative of obfuscated or malicious PowerShell execution. This includes attempts to execute base64 encoded commands, use of `IEX` (Invoke-Expression) with hidden windows and `New-Object`, execution of encoded commands, and use of `WebClient` to download and execute content.
Detects the use of rundll32.exe to launch an NSIS (Nullsoft Scriptable Install System) module, specifically looking for 'nsis_uns' and 'PrintUIEntry' in the command line. This behavior has been observed in the Rhadamanthys infostealer, where rundll32.exe is used to execute its main stealer capability.
This rule identifies when a VPN Tunnel is modified or deleted within Google Cloud Platform. Adversaries may modify or delete VPN tunnels to disrupt network connectivity, reroute traffic, or hinder defensive efforts, impacting the availability or integrity of services.
Detects the creation of a new user account on Linux systems. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system. The rule specifically looks for 'SYSCALL' events where the executable ends with '/useradd' or 'ADD_USER' record types from auditd logs.
This rule detects attempts to enable BPF kprobes tracing on a Linux system. This is achieved by writing '1' to specific files within the '/sys/kernel/debug/tracing/events/kprobes/' directory, specifically targeting '/myprobe/enable' or '/myretprobe/enable'. This activity can be indicative of an attacker attempting to gain deep system visibility or to implement advanced evasion techniques.
This rule detects potential SQL injection attempts by looking for common SQL injection strings and keywords within the URI of GET requests in web server access logs. It specifically targets patterns often used to extract database information, bypass authentication, or execute arbitrary SQL commands.
This rule detects attempts to execute common Windows operating system commands via HTTP GET requests, which is a common characteristic of web shell activity. The rule specifically looks for URL-encoded versions of commands like 'whoami', 'net user', 'cmd /c', 'powershell', 'tasklist', 'wmic', 'ssh', 'python', 'ipconfig', 'wget', 'curl', 'certutil', 'copy \\', 'dsquery', and 'nltest'. These commands are often used by attackers to gain information about the compromised system, escalate privileges, or establish further persistence after deploying a web shell.
Detects the execution of a PowerShell script designed to dump stored credentials from Veeam Backup servers. The script specifically targets the "Veeam.Backup" class and uses `Invoke-Sqlcmd` to extract sensitive information, likely from the Veeam configuration database.
This rule detects when an AWS EC2 snapshot's permissions are modified to allow access from another AWS account. This activity can indicate an attempt to exfiltrate data stored in the snapshot by sharing it with an adversary-controlled account.
Page 411 of 680