SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious command executions on Linux systems, specifically focusing on modifications to file permissions (chmod 777, chmod u+s) and copying of shell binaries (/bin/ksh, /bin/sh). These actions are often associated with malware or hacking activities, such as privilege escalation or establishing persistence.
This rule detects the execution of the 'git clone' command on Linux systems when the command line arguments contain suspicious keywords. These keywords are indicative of activities related to exploits, vulnerabilities, remote code execution (RCE), or proof-of-concept (PoC) code for known vulnerabilities like ProxyShell, Log4Shell, and EternalBlue. The rule aims to identify attempts by adversaries to download malicious or exploit-related code from remote repositories.
This rule detects commands executed on Cisco network devices related to the export of private keys or the import/management of PKI certificates. Specifically, it looks for the commands 'crypto pki export', 'crypto pki import', and 'crypto pki trustpoint'. These actions can indicate an attempt to exfiltrate sensitive cryptographic material (private keys) or to establish new trusted certificates, which could be used for defense evasion or to facilitate man-in-the-middle attacks.
This rule detects NTLM brute force attempts by identifying specific workstation names commonly used by NTLM brute-forcing tools. It looks for Event ID 8004 in the Microsoft-Windows-NTLM/Operational log, specifically when the 'WorkstationName' field matches a list of known tool-related or generic Windows names.
Detects when a password-protected ZIP archive, likely received as an email attachment, is opened. The detection specifically looks for Event ID 5379 (Detailed File Share) in Windows Security logs, where the TargetName indicates a ZIP folder operation within the 'Temporary Internet Files\Content.Outlook' directory. This pattern is indicative of a user interacting with an email attachment that is a password-protected ZIP file.
This rule detects suspicious DNS queries that are characteristic of Cobalt Strike beacons. Specifically, it looks for DNS query names starting with 'aaa.stage.' or 'post.1', or containing '.stage.123456.'. These patterns are known indicators of Cobalt Strike's DNS communication for staging or command and control.
This rule detects a PowerShell downgrade attack where an adversary attempts to force PowerShell to use an older, less secure engine version (2.0) while the host system is configured for a newer version. This technique is often used to bypass security features like Script Block Logging which are present in newer PowerShell versions.
This rule detects the execution of the Tor client or Tor Browser, which are used to connect to the Tor anonymity network. Specifically, it looks for process creation events where the image path ends with '\tor.exe' or '\Tor Browser\Browser\firefox.exe'. This indicates an attempt to establish an anonymous connection, potentially for malicious command and control, data exfiltration, or to bypass network restrictions.
This rule detects potential password spraying attempts that leverage the built-in Windows utility `dsacls.exe`. Specifically, it looks for executions of `dsacls.exe` where the command line includes both the `/user:` and `/passwd:` arguments, indicating an attempt to bind to an LDAP session with specified credentials. This technique can be used by attackers to test a single password against multiple user accounts to avoid account lockouts.
This rule detects the execution of Gpg4win's GnuPG tool (gpg.exe or gpg2.exe) when it is used to encrypt files. The detection specifically looks for command-line arguments that indicate file encryption ('-c') and the use of a passphrase ('passphrase'). This activity can be indicative of malicious actors encrypting data for exfiltration or to render it inaccessible.
Page 420 of 680