SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,512 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects attempts to exploit the Atlassian Bitbucket Command Injection vulnerability (CVE-2022-36804) via the archive API. The rule specifically looks for requests to the '/rest/api/latest/projects/' endpoint containing 'prefix=' and the command injection payload '%00--exec' in the URI query.
Detects potential exploitation attempts of CVE-2023-2283, an authentication bypass vulnerability in libSSH. The exploitation method causes an error message indicating that keys for curve25519 could not be generated. This error message serves as a sign of an exploitation attempt, not necessarily a successful exploitation.
Detects a unique URL marker '/MSHTML_C7/' used in GET requests, which has been associated with RomCom exploitation attempts, potentially leveraging CVE-2023-36884. This marker is indicative of command and control communication or initial access related to the exploit.
Detects the creation of specific executable files, 'jpsetup.exe' or 'jpinst.exe', which have been identified by CISA as indicators of SNAKE malware installation. The rule specifically looks for these filenames in the 'Image' field (process executable path) and excludes cases where the 'CommandLine' is empty or null, or explicitly matches the executable name, to reduce false positives.
Detects the creation of a specific file named 'Comadmin.dat' in the 'C:\Windows\System32\Com\' directory, which is identified as a kernel driver file indicator for the SNAKE malware. This rule aims to identify the presence of this known malicious file.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory with specific uncommon access flags (0x410 and 0x01410). These flags are often used by tools or techniques designed to dump credentials from LSASS, a common method for credential theft on Windows systems. The rule includes extensive filters to reduce false positives from legitimate software that might interact with LSASS.
Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc. This can be used by malicious actors to create malicious Office documents with macros on the fly.
Detects process execution related exceptions in JVM based applications, which can often indicate Remote Code Execution (RCE) attempts. The rule specifically looks for keywords like 'Cannot run program', 'java.lang.ProcessImpl', and 'java.lang.ProcessBuilder' in application error logs.
This rule identifies when an Amazon Elastic Kubernetes Service (EKS) cluster is either created or deleted. Monitoring these events can help detect unauthorized infrastructure changes, potential resource exhaustion, or malicious activity aimed at disrupting services or destroying data within a cloud environment.
This detection uses Azure Activity logs (Administrative category) to identify the deletion of an Azure AD Hybrid Health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is no longer needed via HTTP requests to Azure.
Page 454 of 680