SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,517 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of named pipes that match specific patterns known to be used by Cobalt Strike's Malleable C2 profiles. These patterns are often indicative of Cobalt Strike beacon activity on a system.
This rule detects the loading of the 'Microsoft.ActiveDirectory.Management.dll' DLL via PowerShell's 'Import-Module' or its alias 'ipmo'. This DLL is part of the Active Directory module for PowerShell and is frequently used by attackers to perform Active Directory enumeration, especially in environments where RSAT tools are not installed or administrative privileges are not readily available. The detection focuses on the command line payload containing both the module import command and the specific DLL name.
Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag. This activity is suspicious when not initiated by the expected parent process, 'AppVClient.exe'.
Detects the execution of Netcat (nc.exe, ncat.exe, netcat.exe) with suspicious command-line arguments often associated with establishing listener modes, reverse shells, or proxy connections. Netcat is a versatile networking utility that can be used by adversaries for command and control (C2) communication, data exfiltration, or creating backdoors, often leveraging non-application layer protocols.
Detects potentially suspicious SQL queries executed via sqlcmd.exe targeting Veeam backup databases. The rule specifically looks for commands that attempt to query sensitive tables such as BackupRepositories, Backups, Credentials, HostCreds, SmbFileShares, Ssh_creds, and VSphereInfo, which could indicate an attempt to steal information from the Veeam backup infrastructure.
Detects a network connection initiated from a process located in the "C:\Users\Public" folder. Attackers are known to drop their malicious payloads and malware in this directory as it's writable by everyone. This rule helps hunt for potential suspicious or uncommon activity in the environment.
This rule identifies when a device registered in Azure Active Directory (now Microsoft Entra ID) transitions to a state where it is no longer considered managed or compliant. This could indicate a change in device policy, a device being unenrolled, or a security posture degradation.
This rule identifies sign-in attempts from geographically distant locations within a short timeframe, which is indicative of an "impossible travel" scenario. It also considers if one of these locations is atypical for the user based on their past behavior. This pattern often suggests that an attacker has compromised user credentials and is attempting to access the account from a new, unusual location, potentially using a VPN or proxy service to mask their true origin.
This rule detects the execution of programs from suspicious directories on Linux systems. These directories are commonly used by malware or attackers for staging and executing malicious payloads, including temporary folders, web server directories, and data directories of typically exploited services like PostgreSQL, MySQL, and FTP. The rule specifically looks for SYSCALL events where the executable path starts with one of the predefined suspicious paths.
Detects potential container discovery by monitoring for common Linux utilities (awk, cat, grep, head, less, more, nl, tail) being used to read specific files within the '/proc' virtual filesystem. Specifically, it looks for access to '/proc/2/' (which would typically be kthreadd outside a container) or '/proc/cgroup' and '/proc/sched' which can reveal containerized environments due to differences in their content or PID mappings.
Page 414 of 680