SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects Server-Side Template Injection (SSTI) attempts made via GET requests. The rule looks for common SSTI payload strings within the request, specifically excluding requests that result in a 404 Not Found status code to reduce false positives.
This rule detects potential ReGeorg webshell activity by looking for specific query parameters in web server logs. It focuses on requests that contain 'cmd=read', 'connect&target', 'cmd=connect', 'cmd=disconnect', or 'cmd=forward' in the URI query string, combined with a null referrer and null user agent, and using the POST method. This combination of indicators is highly suspicious for webshell communication.
This rule detects attempts to inject Cross-Site Scripting (XSS) payloads via GET requests in web access logs. It specifically looks for common XSS strings and encoded variations within the request URL, such as '<script>', '<iframe>', '<svg>', 'document.cookie', 'document.domain', 'onerror=', 'onresize=', 'onload=', 'onmouseover=', '${alert', 'javascript:alert', and their URL-encoded forms. The rule filters out requests that result in a 404 HTTP status code to reduce false positives.
Detects when an attacker attempts to establish persistence or escalate privileges on an MSSQL server by adding a new or existing account to the 'sysadmin' fixed server role. This action grants the account full administrative control over the SQL Server instance.
Detects when a diagcab package is loaded from a remote path. This behavior has been observed in the context of the DogWalk vulnerability, where attackers could leverage this to achieve arbitrary code execution.
Detects attempts to export an Exchange mailbox to an unusual file path, specifically to a network share or a file with an .aspx extension, which could indicate an adversary attempting to place a webshell. It also detects the assignment of the 'Mailbox Import Export' role to a user, a prerequisite for performing mailbox exports.
This rule detects the removal of an exported Exchange mailbox using the 'Remove-MailboxExportRequest' cmdlet with the '-Confirm "False"' parameter. This activity could indicate an adversary attempting to cover their tracks after exfiltrating data, potentially following an exploit like ProxyShell.
Detects scenarios where the OpenSSH server starts listening on an SSH socket, which could indicate an attacker enabling the service for remote access or persistence. This rule specifically looks for EventID 4 from the OpenSSH service with the process name 'sshd' and a payload starting with 'Server listening on '.
This rule detects when a Windows Event Log has been cleared. This activity is often performed by attackers to remove traces of their presence on a compromised system. The rule specifically looks for Event ID 517 from the 'Security' provider or Event ID 1102 from the 'Microsoft-Windows-Eventlog' provider, both of which indicate that an event log has been cleared. This can be caused by commands like 'wevtutil cl' or other methods of log manipulation.
Detects when the password policy is enumerated on a Windows system. This activity is logged as Event ID 4661, specifically looking for access rights related to 'ReadPasswordParameters' on objects within the 'Security Account Manager'. This can indicate an adversary attempting to gather information about password requirements to aid in further attacks like password guessing or brute-forcing.
Page 439 of 680