SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,512 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the spawning of suspicious child processes by an Atlassian Confluence server, specifically looking for shell interpreters (sh, bash, dash, ksh, zsh, csh, fish), curl, wget, or python being executed as child processes of the Confluence Java process. This behavior is indicative of successful exploitation of CVE-2022-26134, a critical remote code execution vulnerability in Atlassian Confluence. The rule focuses on the post-exploitation phase where an attacker would execute commands on the compromised server.
Detects the execution of the 'ls -id /' command, which is a common technique used by adversaries to determine if they are running inside a container. The number of inodes for the root directory is typically much higher inside a containerized environment compared to a bare-metal system.
Detects additions or modifications to Emond Launch Daemon rule files or client directories, which adversaries may use to gain persistence and elevate privileges on macOS systems. This rule specifically looks for new or changed files in '/etc/emond.d/rules/' (plist files) or '/private/var/db/emondClients/'.
This rule detects the execution of AppleScript or JavaScript for Automation (JXA) scripts on macOS systems. It specifically looks for the 'osascript' utility being used with command-line arguments that indicate direct script execution ('-e') or the execution of script files with '.scpt' (AppleScript) or '.js' (JavaScript/JXA) extensions. This activity can be indicative of an adversary using scripting interpreters for execution.
Detects enumeration of local system accounts on macOS using various command-line utilities such as 'dscl', 'dscacheutil', 'cat /etc/passwd', 'id', and 'lsof -u'. This activity is indicative of an adversary attempting to discover existing user accounts on a compromised system.
Detects the execution of system utilities commonly used on macOS to discover network connections and logged-in users. These utilities include 'who', 'w', 'last', 'lsof', and 'netstat'. Adversaries may use these commands during the discovery phase to understand the network environment and identify potential targets or communication paths.
This rule detects log entries from Juniper BGP services indicating a missing MD5 digest. This condition can be a sign of a brute-force attack attempting to manipulate routing protocols, potentially leading to BGP hijacking or other network disruptions. BGP uses MD5 for authentication to ensure the integrity and authenticity of routing updates between peers. A missing MD5 digest suggests that an unauthenticated or malicious peer is attempting to establish a connection or send updates.
This rule detects the first-time observation of remote named pipe connections, excluding a predefined list of common and legitimate named pipes. This behavior is often indicative of lateral movement or remote execution using named pipes, which attackers commonly leverage to move within a network or execute code on remote systems. The rule specifically looks for connections to '\\*\IPC$', a common administrative share used for interprocess communication over a network. By filtering out known legitimate named pipes, the rule aims to reduce false positives and highlight potentially malicious activity.
Detects the use of rclone, a command-line program to manage files on cloud storage, by identifying its default user-agent string in proxy logs. This activity can indicate data exfiltration to cloud storage services.
Detects events generated by user-mode applications when they call the CveEventWrite API, indicating that a known vulnerability is potentially being exploited. Microsoft started using this log in January 2020, notably with CVE-2020-0601 (a Windows CryptoAPI vulnerability). However, the rule's description notes that this log has historically seen limited use for reporting CVEs.
Page 450 of 680