SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects attempts to query the 'MachineGuid' from the Windows Registry using the 'reg.exe' utility. The MachineGuid is a unique identifier for a Windows machine and its discovery can be an early step in an adversary's reconnaissance phase to identify the system they have compromised.
Detects the creation of suspicious child processes by 'scrcons.exe' (Script Event Consumer). 'scrcons.exe' is a legitimate Windows component used for WMI event handling, but its spawning of common scripting interpreters, proxy execution binaries, or task schedulers can indicate malicious activity, often related to persistence or execution techniques leveraging WMI.
This rule detects the execution of 'ssh.exe' with command-line arguments indicating RDP port forwarding (tunneling). Specifically, it looks for the presence of ':3389' in the command line, which is the default port for RDP. This activity can be used by adversaries to establish a tunnel for remote access, bypassing network restrictions and potentially exfiltrating data.
Detects suspicious child processes spawned by WmiPrvSE.exe, which is often abused by adversaries for execution and defense evasion. The rule specifically looks for common Living Off The Land Binaries (LOLBINs) and scripting interpreters being launched by WmiPrvSE, including certutil, cscript, mshta, msiexec, regsvr32, rundll32, verclsid, wscript, and cmd.exe with specific command-line arguments related to scripting or LOLBINs.
Detects exploitation attempts targeting Pulse Secure VPN appliances via CVE-2019-11510. Specifically, it looks for requests to a URI path containing '/dana/html5acc/guacamole/', which is indicative of an attacker attempting to access the Guacamole component of the Pulse Secure appliance.
Detects exploitation attempts against Citrix Netscaler, Application Delivery Controller, and Citrix Gateway devices targeting CVE-2019-19781. The rule looks for specific URI query patterns indicative of directory traversal or direct access to vulnerable scripts.
This rule detects command-line patterns associated with potential Russian APT credential theft activities, specifically targeting Active Directory data. It looks for the use of `xcopy` to copy the `sysvol` directory, which can contain sensitive information, and `adexplorer` to create a snapshot of Active Directory data, typically saved as a `.snp` file in a user's downloads directory. These actions are indicative of adversaries attempting to exfiltrate or analyze Active Directory credentials and configuration.
This rule detects the creation of a new process where the parent process is 'svchost.exe' with the command line containing '-k RPCSS'. This specific parent process signature is associated with the Remote Procedure Call (RPC) service. The rule aims to identify unusual child processes spawned by the RPC service, which could indicate an exploitation attempt of vulnerabilities like CVE-2022-26809. It's considered a 'long shot' detection, meaning it targets anomalous behavior rather than a direct exploit signature.
Detects an attempt to leverage the vulnerable servlet "mboximport" for an unauthenticated remote command injection in Zimbra Collaboration Suite Email Server, specifically targeting CVE-2022-27925. The rule looks for POST requests to the '/service/extension/backup/mboximport' endpoint with specific query parameters ('account-name', 'ow', 'no-switch', 'append') and then checks for subsequent requests to '/zimbraAdmin/*.jsp' with a 200 status code, indicating potential successful exploitation and web shell access.
Detects the creation of the default named pipe '\PSEXESVC' which is commonly used by PsExec for remote service execution. This pipe is created when PsExec attempts to establish a service on a remote system to execute commands.
Page 437 of 680