SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,515 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of named pipes that have been observed in use by known APT groups or malware. This rule specifically looks for a predefined list of pipe names associated with various malicious activities, including those used by Project Sauron, SolarWinds SUNBURST, LiquidSnake, Turla HyperStack, Sofacy group malware, Hidden Cobra Hoplight, Pacifier, Snatch Ransomware, Covenant, Qbot, Uroburos Malware, PoshC2, Wild Neutron, Cloud Hopper (RedLeaves), Equation Group malware, Cobra Trojan, Crackmapexec, and Emissary Panda (Hyperbro).
This rule detects attempts to tamper with Windows audit policies using the `auditpol.exe` utility. Threat actors often modify audit policies to impair detection capabilities by disabling, clearing, removing, or restoring specific audit policies, thereby reducing the logging of their malicious activities.
This rule detects attempts to harvest Wi-Fi credentials using the `netsh.exe` utility. Specifically, it looks for `netsh.exe` execution with command-line arguments that indicate an attempt to display WLAN profiles and their keys in clear text, which is a common technique used by malware like Agent Tesla to steal Wi-Fi passwords.
Detects Elise backdoor activity, specifically looking for the creation of a svchost.exe process in a suspicious path and the deletion of a NavShExt.dll file, which are indicators of the Elise malware used by APT32.
Detects exploitation attempts against the Log4j RCE vulnerability (CVE-2021-44228), commonly known as Log4Shell. The rule specifically looks for various JNDI injection patterns within web server log fields such as User-Agent, URI query, and Referer headers, which are common vectors for this vulnerability.
Detects the removal of packages on Linux systems using common package managers such as 'yum', 'apt', 'apt-get', 'dpkg', and 'rpm'. This activity could be indicative of an adversary attempting to remove forensic artifacts or security tools.
Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify successful exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.
RDP login with localhost source address may be a tunnelled login
This rule detects attempts to exploit the Zerologon vulnerability (CVE-2020-1472) using tools like Mimikatz or other exploits originating from a machine with 'kali' in its hostname. It specifically looks for Windows System event IDs 5805 or 5723 in conjunction with the keywords 'kali' or 'mimikatz'.
This rule detects the use of Mimikatz by looking for specific keywords associated with its modules and functionalities within Windows Event Logs. These keywords cover various Mimikatz features, including credential dumping (LSASS, SAM, LSA secrets), Kerberos ticket manipulation (golden ticket, pass-the-ticket), DPAPI masterkey extraction, and other miscellaneous functions. Some keywords may be more prevalent in older Mimikatz versions but are still used by threat actors.
Page 413 of 680