SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects suspicious process creation activity involving 'rundll32.exe' executing a DLL from a user's local application data directory, specifically looking for command-line patterns that include '.dat"' or '.dll #1'. This behavior is characteristic of the Sofacy (APT28) Trojan loader. The rule filters out executions from the temporary directory to reduce false positives.
This rule detects potential activity associated with the EmpireMonkey APT group. Specifically, it looks for process creation events where the command line contains both '/e:jscript' and '\Local\Temp\Errors.bat'. This combination suggests the execution of a JScript file, possibly a malicious script, from a temporary directory, which is a common tactic used by threat actors for defense evasion and execution.
Detects CVE-2021-22123 exploitation attempt against Fortinet WAFs
Detects an authentication bypass vulnerability (CVE-2021-40539) affecting the REST API URLs in Zoho ManageEngine ADSelfService Plus. The rule specifically looks for requests to vulnerable endpoints that could be used to exploit this flaw.
Detects URL patterns and status codes that indicate a successful ProxyShell exploitation attack against Microsoft Exchange servers. The rule looks for requests to '/autodiscover.json' combined with specific URI paths like '/powershell', '/mapi/nspi', or '/EWS', and successful HTTP status codes (200 or 301).
Detects the creation of specific files associated with the Goofy Guineapig malware, which attempts to impersonate Google Update components. The rule looks for 'config.dat', 'GoogleUpdate.exe', 'tmp.bat', and 'goopdate.dll' within the 'C:\ProgramData\GoogleUpdate\' directory.
Detects the creation of a file named "MoriyaStreamWatchmen.sys" in the 'C:\Windows\System32\drivers\' directory. This specific filename is associated with the Moriya rootkit, as detailed in the Securelist's "Operation TunnelSnake" report. The presence of this file indicates a potential rootkit installation attempt, which could lead to persistence and privilege escalation on a Windows system.
Detects potential exploitation attempts of CVE-2022-21587, an arbitrary file upload vulnerability impacting Oracle E-Business Suite (EBS). This vulnerability can lead to unauthenticated remote code execution.
This rule detects potential exploitation attempts targeting the Centos Web Panel (CWP) 7, specifically looking for indicators related to CVE-2022-44877, an unauthenticated remote code execution vulnerability. The detection logic focuses on POST requests to '/login/index.php' containing specific query parameters and keywords often associated with reverse shells or command injection, such as 'login=$(' or base64 encoded 'python' strings.
This rule detects suspicious command line patterns associated with MERCURY APT activity. Specifically, it looks for PowerShell execution with parameters '-exec bypass -w 1 -enc' combined with a base64 encoded string that decodes to 'Start-Job -ScriptBlock'. This indicates the execution of an encoded PowerShell script, often used by adversaries to obfuscate their commands and evade detection.
Page 487 of 680