SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of a new named pipe using the 'mkfifo' utility on Linux systems. Named pipes can be used for inter-process communication and can sometimes be leveraged by adversaries for various purposes, including data exfiltration, command and control, or as a component of more complex malware.
Detects the execution of netcat or ncat with the '-e' or '-c' flag, combined with common shell commands. This pattern is indicative of an attempt to establish a reverse shell, where a shell is spawned and connected back to an attacker-controlled listener.
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite. This activity is indicative of the OMIGOD vulnerability exploitation.
This rule detects attempts to disable security tools on Linux systems. Specifically, it looks for command-line invocations of `iptables`, `ip6tables`, `firewalld`, `cbdaemon` (Carbon Black), `falcon-sensor` (CrowdStrike), and `setenforce` (SELinux) with arguments indicating a stop or disable action. This activity is often associated with adversaries attempting to impair defenses to facilitate further malicious actions.
Detects the execution of 'xterm' with command-line arguments indicative of a reverse shell connection, specifically looking for '-display' and a display value ending in ':1'. This pattern is commonly used by attackers to establish a reverse shell.
Detects suspicious child processes spawned from web browsers on macOS. This activity often indicates a potential web browser exploitation attempt, where an attacker leverages a browser vulnerability to execute arbitrary commands or scripts on the system. The rule specifically looks for common scripting and command-line interpreters being launched as child processes of various browsers, while filtering out known legitimate browser-related activities like updates or recovery scripts.
This rule detects when a monitor, SPAN (Switched Port Analyzer), or RSPAN (Remote Switched Port Analyzer) is configured or modified on a Cisco network device. These configurations are often used for network sniffing or traffic analysis, which can be legitimate for troubleshooting but also abused by adversaries for data exfiltration or reconnaissance.
This rule detects the execution of 'show history', 'show history all', or 'show logging' commands on Cisco devices. These commands can expose sensitive information, including credentials, that have been entered into the device's command-line interface. Adversaries may use these commands to gather credentials or other sensitive configuration details from network devices.
Detects connections made by Microsoft BITSAdmin to domains using uncommon Top-Level Domains (TLDs). This can indicate command and control activity or data exfiltration where an adversary is attempting to blend in with legitimate traffic but using less common TLDs to avoid common filtering.
Detects exploitation attempts using the JNDI-Exploit-Kit by looking for specific URI patterns in web server logs. These patterns are indicative of various JNDI injection payloads designed to achieve remote code execution, reverse shells, or memory shell deployments on vulnerable applications like Tomcat, Jetty, Weblogic, JBoss, Websphere, and Spring.
Page 470 of 680