SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects changes to the "AutodialDLL" registry key, which can be used as a persistence method to load custom DLLs via the "ws2_32" library. This technique allows an attacker to execute malicious code every time a process loads the Winsock2 library.
Detects the execution of a renamed SysInternals tool, specifically 'ps.exe', with command-line arguments '-accepteula' and '-s cmd /c netstat'. This specific combination has been observed in attacks attributed to the Dragonfly APT group and is documented in the US-CERT TA17-293A alert.
Detects potential QakBot activity by identifying specific process execution patterns previously associated with the malware. This includes scenarios where WinRAR executes wscript.exe, command lines containing 'ping.exe -n 6 127.0.0.1 & type', or regsvr32.exe executing from 'C:\ProgramData' with a '.tmp' file.
Detects exploitation attempts of the Microsoft Exchange vulnerability CVE-2020-0688. This vulnerability allows for remote code execution due to improper validation of cmdlet arguments. The rule specifically looks for GET requests to '/ecp/' or '/owa/' paths containing '__VIEWSTATE=' in the query string, which is indicative of the exploitation attempt.
This rule detects registry modifications associated with the Ke3chang/TidePool malware families. Specifically, it looks for command-line arguments used to modify the 'Check_Associations', 'DisableFirstRunCustomize', and 'IEHarden' registry keys. These modifications are known to be unique to these malware families and were observed in campaigns in 2019 and 2020.
Detects exploitation attempts against the Oracle WebLogic server vulnerability CVE-2021-2109. The rule specifically looks for GET requests containing 'com.bea.console.handles.JndiBindingHandle', 'ldap://', and 'AdminServer' in the URI query, which are indicators of an attempted JNDI injection via LDAP.
Detects exploitation attempts targeting the VMware View Planner vulnerability, CVE-2021-21978. This vulnerability allows for arbitrary file upload due to an unrestricted file upload flaw in the 'upload' function, specifically within the 'wsgi_log_upload.py' script. Attackers can leverage this to upload malicious files, potentially leading to remote code execution.
Detects the spawning of suspicious child processes by the Atlassian Confluence server, which may indicate successful exploitation of CVE-2021-26084. The rule specifically looks for the Confluence Java process spawning common command-line utilities and scripting interpreters often used in post-exploitation activities.
Detects successful exploitation attempts of the Microsoft Exchange Server vulnerability CVE-2021-28480. This vulnerability allows for remote code execution. The rule specifically looks for POST requests to '/owa/calendar/a' that result in an HTTP 503 status code, indicating a potential successful exploitation or a server error due to the exploit.
This rule detects suspicious behaviors associated with the SOURGUM actor, as tracked by Microsoft. Specifically, it looks for the creation of processes with specific image paths related to 'Physmem.sys' or 'WimBootConfigurations.ini' within IME directories. Additionally, it identifies attempts to modify registry keys associated with Component Object Model (COM) objects, specifically InprocServer32 entries for CLSIDs {7c857801-7381-11cf-884d-00aa004b2e24} and {cf4cc405-e2c5-4ddd-b3ce-5e7582d8c9fa}, using the 'reg add' command.
Page 467 of 680