SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects a specific child/parent process relationship indicative of a "WerFault" process running from the "WinSxS" directory as a service. This behavior has been reported by CISA as indicative of potential SNAKE malware activity.
Detects potential shellcode injection attempts by monitoring process access events where a process requests specific access rights (0x147a or 0x1f3fff) and the call trace contains 'UNKNOWN'. This behavior is characteristic of tools like Metasploit's migrate and Empire's psinject, which inject shellcode into other processes. The rule includes filters to reduce false positives from legitimate system processes like Wmiprvse.exe accessing Lsass.exe, Dell software interactions, and Microsoft Visual Studio processes.
This rule detects the creation of an 'explorer.exe' child process from common shell processes such as 'cmd.exe', 'powershell.exe', or 'pwsh.exe'. Attackers may use 'explorer.exe' as a proxy for execution to evade defense mechanisms. While this activity can be legitimate, it is often indicative of anomalous behavior and has been observed in use by threat actors like Muddy Waters.
Detects the execution of known tunneling and exfiltration tools such as httptunnel, plink, socat, and stunnel. These tools can be abused by adversaries to establish covert communication channels, bypass network restrictions, and exfiltrate data from compromised systems.
Detects potential suspicious execution of a process from a GUID-like folder name located in a suspicious temporary directory, a technique observed in IcedID attacks. This rule is designed to identify uncommon and potentially malicious activity stemming from such folders.
Detects errors in NodeJS applications related to process execution, specifically looking for the keyword 'node:child_process'. These errors, especially if triggered by user input, may indicate an attempted Remote Code Execution (RCE) vulnerability exploitation.
Detects when an AWS Elastic Container Service (ECS) Task Definition is created, described, or run, and its container definition includes a command that queries the AWS container credential endpoint. This activity can indicate an adversary attempting to establish persistence or escalate privileges by backdooring task definitions to extract credentials.
Identifies when an Azure Application Security Group is modified or deleted. This could indicate an attempt to alter network access controls, potentially to bypass security measures or disrupt services.
This rule detects when an end user grants consent to an application in Azure Active Directory (now Microsoft Entra ID). Specifically, it triggers when the 'ConsentContext.IsAdminConsent' field is 'false', indicating that the consent was given by a regular user rather than an administrator. This activity can be a precursor to adversaries stealing application access tokens by tricking users into authorizing malicious applications.
This rule detects an anomaly in the SAML token issuer, indicating a potential compromise of the SAML token. The detection is triggered when the 'riskEventType' is 'tokenIssuerAnomaly', suggesting that the claims within the token are unusual or align with known attacker patterns. This could signify an adversary forging web credentials, specifically SAML tokens, to gain unauthorized access.
Page 442 of 680