SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365. This rule will apply to ExchangePowerShell usage and from the cloud.
Detects when the Microsoft 365 Security Compliance Center restricts a user from sending email because they exceeded service sending limits. This could indicate a compromised account being used for spamming or other malicious activities, or a legitimate user exceeding limits due to unusual activity.
Detects attempts to collect image data stored in the clipboard from users using the 'xclip' tool. This rule specifically looks for 'xclip' execution with parameters indicating selection from the clipboard for image data output. It is highly recommended for server environments due to frequent legitimate clipboard utility usage on user workstations.
Detects attempts to overwrite or wipe files using the 'dd' command with '/dev/null' or '/dev/zero' as input. This technique is commonly used for data destruction, making files irrecoverable.
This rule detects attempts to masquerade as the Linux 'crond' process by copying '/bin/sh' to a file ending with '/crond' and executing it. This technique is often used by adversaries to evade detection by making malicious processes appear as legitimate system services.
Detects the use of the 'xwd' utility to capture screenshots on a Linux system. This rule is particularly relevant for server environments where screenshot utilities are less commonly used by legitimate users, reducing false positives. The detection logic specifically looks for 'xwd' execution with parameters indicating a screen capture, such as '-root' or '-out' followed by a file ending in '.xwd'.
This rule detects an anomaly in Apache Guacamole sessions where two users are simultaneously present in the same session. This could indicate unauthorized access, session hijacking, or a shared credential scenario that deviates from normal behavior.
Detects exploitation attempts related to the Nimbuspwn privilege escalation vulnerabilities (CVE-2022-29799 and CVE-2022-29800) on Linux systems. The rule looks for specific keywords that indicate the `networkd-dispatcher` service is being manipulated, potentially to execute arbitrary code with elevated privileges.
This rule detects a suspicious command sequence often associated with the JexBoss exploitation tool. Specifically, it looks for the execution of 'bash -c /bin/bash' followed by a network connection attempt using '&/dev/tcp/'. This combination indicates an attempt to establish a reverse shell or exfiltrate data over TCP.
Detects the creation of the file "/tmp/rootlog" which is used by the TripleCross eBPF rootkit as a way to check if the backdoor is already running. This file acts as a lockfile to prevent multiple instances of the rootkit from running simultaneously.
Page 479 of 680