SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects attempts to coerce authentication using the PetitPotam technique. It specifically looks for Windows Security Event ID 5145, which indicates a network share access, where the ShareName starts with '\\' and ends with '\IPC$', the RelativeTargetName is 'lsarpc', and the SubjectUserName is 'ANONYMOUS LOGON'. This combination of events is indicative of a PetitPotam attack attempting to force a domain controller to authenticate to a malicious server.
This rule detects when the Notepad++ updater utility (GUP.exe) is executed by a process other than Notepad++ itself, specifically when command-line arguments indicate a file download operation (containing '-unzipTo' and 'http'). This behavior can be indicative of an adversary abusing a legitimate application's updater for ingress tool transfer or other malicious file downloads, bypassing typical security controls that might monitor direct download utilities.
Detects the execution of PowerShell commands embedded within a link (.lnk) file. This rule specifically looks for instances where 'explorer.exe' launches 'cmd.exe', and the command line of 'cmd.exe' contains both 'powershell' and '.lnk', indicating an attempt to execute PowerShell via a shortcut file.
Detects the execution of `sqlcmd.exe` with command-line arguments indicative of database enumeration or backup activities, specifically targeting common system databases and processes. This pattern has been associated with Conti ransomware for dumping database contents.
Detects HTTP requests to URIs ending with the ".class" extension. This can indicate attempts to download Java classes, potentially as part of exploitation attacks such as Log4shell against Log4j vulnerabilities. This rule is useful for threat hunting to identify such activities.
Detects potential OGNL Injection exploitation attempts in JVM-based applications, which could lead to Remote Code Execution (RCE). This rule specifically looks for error messages indicating OGNL parsing failures, such as 'org.apache.commons.ognl.OgnlException' or 'ExpressionSyntaxException', which are common indicators when an attacker attempts to inject malicious OGNL expressions. This type of vulnerability has been exploited in high-profile cases like Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134).
Detects attempts to exfiltrate data by posting a file using the `wget` utility. This can be particularly dangerous if an adversary leverages misconfigured sudo permissions for `wget` to read sensitive files like `/etc/shadow` and then exfiltrate them.
This rule detects suspicious command-line executions that attempt to create symbolic links to the `/etc/passwd` file. Attackers might do this to gain unauthorized access to user account information, potentially leading to credential dumping or privilege escalation. The rule specifically looks for `ln -s /etc/passwd` and `ln -s -f /etc/passwd` patterns in command lines.
This rule detects attempts to copy the 'passwd' or 'shadow' files from the '/tmp/' directory using the 'cp' command. This activity is highly suspicious as these files contain sensitive user account information, including password hashes (in the case of 'shadow'), and should not typically be copied to temporary directories. An adversary might do this to exfiltrate credentials for offline cracking or to move them to a location accessible for further exploitation.
Detects the installation of new root certificates on a Linux system. Attackers may install root certificates to bypass security warnings when connecting to adversary-controlled web servers or C2 infrastructure, making their malicious traffic appear legitimate. This rule specifically looks for the execution of common Linux utilities used for managing CA certificates: 'update-ca-certificates' and 'update-ca-trust'.
Page 417 of 680