SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the use of `System.IdentityModel.Tokens.KerberosRequestorSecurityToken` within PowerShell script blocks. This specific class is used to request Kerberos service tickets (TGS) for a given Service Principal Name (SPN). This behavior is commonly observed in Kerberoasting attacks (T1558.003) where an attacker requests service tickets to crack their hashes offline, or in some cases, during the initial stages of a silver ticket attack (T1558.002) to gather SPNs. A successful execution of such a script would typically output the SPNs for the targeted endpoint.
Detects PowerShell scripts that contain references to the .NET `[System.Windows.Input.Keyboard]::IsKeyDown` function, which can be used for keystroke capturing. This function checks if a specified key is pressed, making it a common indicator of potential keylogger activity within PowerShell scripts.
Detects potential process patterns related to Cobalt Strike beacon activity. This includes specific command-line executions like 'whoami' from the C:\Temp\ directory, or 'cmd.exe /c echo' piping output to a named pipe when the parent process is 'runonce.exe' or 'dllhost.exe'. It also identifies 'conhost.exe' being spawned with particular arguments in conjunction with these suspicious parent command lines.
Detects suspicious child processes spawned by common Windows shell and scripting processes such as mshta.exe, powershell.exe, rundll32.exe, cscript.exe, wscript.exe, wmiprvse.exe, and regsvr32.exe. The suspicious child processes include schtasks.exe, nslookup.exe, certutil.exe, bitsadmin.exe, and mshta.exe, which are often abused for various malicious activities like persistence, data exfiltration, or further execution.
This rule detects the execution of 'csc.exe' as a sub-process of 'WINWORD.EXE'. This specific process relationship is indicative of exploitation attempts leveraging CVE-2017-8759, where a crafted document (opened by Winword) can lead to the execution of arbitrary code, often using csc.exe (C# compiler) to compile and execute malicious code on the fly.
Detects command-line indicators associated with the APT29 (Cozy Bear) 2018 phishing campaign, specifically looking for PowerShell execution with '-noni -ep bypass' and the presence of 'cyzfc.dat' and 'PointFunctionCall' in the command line. These indicators are linked to the group's methods for executing malicious code and potentially bypassing security measures.
Detects the exploitation of the Wazuh RCE vulnerability described in CVE-2021-26814. This rule specifically looks for a URI query containing '/manager/files?path=etc/lists/../../../../..' which is indicative of a path traversal attempt to access sensitive files outside the intended directory.
Detects a potential exploitation attempt of CVE-2023-25157, a SQL injection vulnerability in GeoServer. The rule looks for specific GET requests to '/geoserver/ows' containing 'CQL_FILTER=' along with known vulnerable functions or SQL injection keywords in the query string.
Detects potential command and control (C2) beaconing activity to domains identified as being used in the 'Operation Triangulation' campaign, which targeted iOS devices with 0-day exploits. This rule specifically looks for connections to a list of known malicious domains via proxy logs.
Detects the execution of a PowerShell script known as POWERHOLD, which has been attributed to the FIN7 threat group. The rule specifically looks for the presence of '$env:APPDATA', 'function MainPayload', '::WriteAllBytes', and 'wscript.exe' within the PowerShell script block text, indicating the execution of this specific malicious script.
Page 423 of 680