SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,515 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects command-line operations that interact with common shell history files on macOS systems. Adversaries often target these files (e.g., .bash_history, .zsh_history) to extract sensitive information such as credentials or commands executed by users, which can aid in further compromise or understanding the environment.
Detects the execution of 'osacompile' by potentially suspicious parent processes such as 'applet' or 'osascript'. This activity can indicate an attempt to compile AppleScript or JavaScript for Automation (JXA) code, which adversaries might use for execution or obfuscation.
This rule detects attempts to disable logging on Cisco devices by looking for specific commands such as 'no logging' or 'no aaa new-model'. Adversaries may disable logging to evade detection and hinder forensic analysis.
This rule detects attempts to shut down a Cisco device or change its boot mode by looking for specific keywords in Cisco AAA logs. The keywords 'shutdown', 'config-register 0x2100', and 'config-register 0x2142' indicate actions that can lead to a denial of service or a change in the device's operational state.
This rule detects HTTP requests containing user-agent strings commonly associated with known scanning and reconnaissance tools such as Wfuzz, WPScan, and Recon-ng. These tools are often used by attackers to gather information about web applications and infrastructure before launching an attack.
Detects the deletion of a backup catalog on Windows systems. This action can be performed by adversaries to inhibit system recovery, making it harder to restore systems after an attack, such as a ransomware incident.
This rule detects specific patterns indicative of successful ProxyLogon exploitation targeting Microsoft Exchange's OabVirtualDirectory. It looks for the invocation of the 'Set-OabVirtualDirectory' cmdlet in conjunction with suspicious parameters often used in post-exploitation activities, such as injecting web shell code ('eval(request'), or manipulating the ExternalUrl with malicious scripts ('http://f/<script', '"unsafe"};', 'function Page_Load()'). This combination suggests an attacker has successfully leveraged the ProxyLogon vulnerabilities to execute arbitrary commands and modify Exchange configurations for persistence or further access.
Detects PowerShell commands attempting to load .NET assemblies reflectively using Base64 encoded strings. This technique is often used by adversaries to execute malicious code in memory, evading disk-based detections.
Detects exploitation attempts against Fortinet SSL VPNs using the CVE-2018-13379 vulnerability. This vulnerability allows an unauthenticated attacker to read arbitrary files on the system via a specially crafted URI.
Detects exploitation attempts of CVE-2021-41773, a path traversal vulnerability in Apache HTTP Server 2.4.49. This flaw allows an attacker to map URLs to files outside the expected document root, potentially leading to information disclosure (e.g., source code of CGI scripts) or arbitrary file access if not properly protected. This vulnerability has been actively exploited in the wild and specifically affects Apache HTTP Server version 2.4.49.
Page 418 of 680