SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects DNS queries for subdomains associated with the MEGA cloud storage service, specifically 'userstorage.mega.co.nz'. Such queries can indicate attempts to exfiltrate data to MEGA, potentially using tools like Rclone, or legitimate usage of the service. The rule focuses on the DNS layer to identify communication with this cloud storage provider.
Detects DNS queries to "ufile.io", which has been observed as a method for data exfiltration by malware and threat actors. This service can be used to upload and share files, making it a convenient target for adversaries to move stolen data out of a compromised network.
Detects the creation of new DLL assembly files by "aspnet_compiler.exe" within the 'Temporary ASP.NET Files' directory, specifically in the 'assembly\tmp\' subdirectory. This activity could indicate abuse of "aspnet_compiler" to proxy execution through a build provider, potentially for malicious purposes.
Detects the creation of specific file artifacts associated with Adwind RAT (also known as jRAT). This includes 'javaw.exe' within the AppData\Roaming\Oracle\bin\java directory and '.vbs' files within a '\Retrive' directory, both known indicators of Adwind/jRAT activity.
Detects the creation of an 'ntds.dit' file, which contains Active Directory database information including credential hashes, by processes commonly abused by attackers or processes running from suspicious directories like 'Temp' or 'AppData'. This activity is highly indicative of credential dumping attempts.
This rule detects when common Windows shell and scripting applications (such as bash.exe, cmd.exe, cscript.exe, powershell.exe, certutil.exe, mshta.exe, wmic.exe, etc.) write files to suspicious system folders. The suspicious folders include 'C:\PerfLogs\', 'C:\Users\Public\', and 'C:\Windows\Temp\'. This activity can indicate an adversary attempting to stage or execute malicious payloads in less scrutinized directories for persistence or defense evasion.
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters in filenames. This is used as an obfuscation and masquerading technique. The rule specifically targets "perfect" homoglyphs that are indistinguishable from ASCII characters.
Detects a specific User Account Control (UAC) bypass technique involving the creation of a file named 'comctl32.dll' within a directory structure that starts with 'C:\Windows\System32\consent.exe.@'. This pattern is indicative of UACMe (specifically UACMe 22) attempting to elevate privileges by manipulating how consent.exe loads libraries.
This rule detects the creation of files with specific web-related extensions (.ashx, .asp, .ph, .soap) in common web server directories such as '\inetpub\wwwroot\', '\www\', '\htdocs\', or '\html\'. This activity is often indicative of an attacker uploading a web shell to maintain persistence or execute commands on the compromised web server.
Detects file renames where the target filename uses an uncommon double extension. This behavior is often associated with ransomware activity, where files are encrypted and then renamed with a custom extension, such as ".jpg.crypted" or ".docx.locky". The rule specifically looks for common document and image file extensions followed by another extension, while filtering out known legitimate backup or temporary file extensions.
Page 472 of 680