SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects attempts to exploit CVE-2020-10148, an authentication bypass vulnerability in SolarWinds Orion API. This rule looks for specific URI query patterns associated with the exploit, while excluding legitimate requests.
Detects the deployment of "Golden Chickens" malware, a method used by the Evilnum APT group. This rule specifically looks for the execution of 'regsvr32.exe' with specific command-line arguments that indicate the registration of an OCX file located in the user's AppData\Roaming directory. This technique is often used for defense evasion and persistence.
Detects specific command-line arguments used by the Conti ransomware during its execution phase. The rule looks for a combination of arguments including '-m ', '-net ', '-size ', '-nomutex ', and '-p \\', which are characteristic of Conti's encryption process. This pattern indicates the ransomware is likely attempting to encrypt files on the system or network shares.
Detects the creation of a Windows service named 'GoogleUpdate' with a specific ImagePath containing 'rundll32', 'FileProtocolHandler', and '\ProgramData\GoogleUpdate\GoogleUpdate.exe'. This pattern is associated with the Goofy Guineapig backdoor for persistence.
Detects exploitation attempts targeting Microsoft Exchange servers, specifically those associated with the HAFNIUM group's activity. The rule looks for suspicious POST requests to specific URI paths and user-agent strings that were observed during the HAFNIUM attacks.
Detects command-line executions where a file path ends with a period (e.g., 'file.exe.'). This technique has been observed in campaigns associated with the Raspberry Robin worm to potentially evade detection or confuse users.
Detects changes to Outlook registry values indicating a reminder was triggered for a Note or Task item. This activity could be related to the exploitation of CVE-2023-23397, a critical vulnerability in Microsoft Outlook that allows for NTLM relay attacks without user interaction. Further investigation is required to determine the success of an exploitation.
Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884. The rule looks for GET requests where the URI contains a file extension like .zip, .asp, .htm, .url, .xml, .chm, .mht, .vbs, or .search-ms, followed by '?d=' and an IPv4 address.
Detects HTTP GET requests for specific file paths associated with the RomCom threat actor, potentially exploiting CVE-2023-36884. These file paths include various file types such as .url, .search-ms, .vbs, .mht, and .asp, which are likely used for initial access or further stages of the attack.
Detects access to a file share with a specific naming schema ('\MSHTML_C7\' and an IP address pattern) that has been observed during exploitation of CVE-2023-36884. This rule looks for Windows Security Event ID 5140 (A network share object was accessed) where the ShareName or ShareLocalPath contains the characteristic string and an IP address.
Page 476 of 680