SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects attempts to exploit the Print Spooler vulnerability CVE-2021-1675, also known as PrintNightmare. It specifically looks for Event ID 316 in the Print Service Operational log, which indicates a driver load event. The rule further refines detection by searching for keywords such as 'UNIDRV.DLL, kernelbase.dll,', '123', '1234', or 'mimispool', which are associated with known exploitation methods for this vulnerability. Successful exploitation often involves loading malicious drivers or DLLs through the print spooler service.
Detects exploitation attempts targeting CVE-2021-27905, an arbitrary file read and SSRF vulnerability affecting Apache Solr versions up to and including 8.8.1. The rule looks for specific patterns in HTTP request URIs that are indicative of this vulnerability being exploited, such as requests containing '/solr/', '/debug/dump?', 'param=ContentStream', or 'command=fetchindex' with 'masterUrl='.
Detects the loading of a malicious 'version.dll' from the 'C:\Windows\ADFS\' directory, a technique used by the NOBELIUM threat group with their FoggyWeb backdoor to achieve DLL hijacking.
Detects exploitation attempts of the OWASSRF vulnerability targeting Microsoft Exchange servers using publicly available Proof-of-Concept (POC) code. This rule specifically looks for requests to the OWA endpoint attempting to access the PowerShell backend endpoint, characterized by a specific user agent, POST method, successful status code (200), and URI query containing both '/owa/mastermailbox' and '/powershell'. This indicates an attempt to leverage the vulnerability for remote code execution.
Detects the execution of 'wget' to download a '.tar' file from an untrusted direct IP address, specifically when the '--no-check-certificate' flag is used. This behavior has been observed in attacks attributed to UNC4841 during their exploitation of Barracuda ESG zero-day vulnerabilities.
Detects exceptions in the Velocity template renderer, which likely indicates dynamic rendering of user-controlled input. This vulnerability, known as Server-Side Template Injection (SSTI), can lead to Remote Code Execution (RCE) if successfully exploited.
Identifies when the default Amazon Elastic Block Store (EBS) encryption is disabled in a specific AWS region. Disabling default encryption does not affect existing volumes but means newly created volumes will not be encrypted by default, potentially impacting data confidentiality and integrity.
This rule detects attempts to export an AWS EC2 instance, specifically when the 'CreateInstanceExportTask' event is logged in AWS CloudTrail. This action can be an indicator of an adversary attempting to exfiltrate data from a compromised EC2 instance by exporting it as a virtual machine image. The rule specifically looks for successful export task creations, filtering out events that contain error messages or codes, or indicate a 'Failure' in the response elements.
This rule detects when an AWS RDS database instance is restored from a snapshot and configured to be publicly accessible. This activity could indicate an attempt to exfiltrate data by making a copy of a database publicly available.
This rule detects attempts to shut down or reboot a Linux system using common commands like 'shutdown', 'reboot', 'halt', 'poweroff', or by using 'init' or 'telinit' with specific runlevel arguments (0 for halt/shutdown, 6 for reboot). Adversaries may use these methods to disrupt system availability or aid in the destruction of data.
Page 426 of 680