SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects potential exploitation attempts of CVE-2023-23752, an improper access check vulnerability in Joomla's web service endpoints. The detection specifically looks for GET requests to the '/api/index.php/v1/' path with the 'public=true' query parameter, which is indicative of an attempt to bypass access controls.
Detects a crash of the "WinRAR.exe" application with a version lower than 6.23, which could indicate an attempted exploitation of CVE-2023-40477. The rule specifically looks for Application Error events (EventID 1000) where the provider is 'Application Error' and the crashing application is 'WinRAR.exe', excluding versions 6.23 and higher.
Detects the creation of a file named 'newdev.dll' in a user's AppData\Roaming directory. This specific file path and name are associated with the COLDSTEEL Remote Access Trojan (RAT) for persistence.
Detects the creation of a process executing as a user named "ANONYMOUS" where the parent process image path contains common system or user application directories. This behavior has been observed in the "MileStone2016" variant of the COLDSTEEL RAT.
This rule detects process creation events indicative of the Griffon malware. Specifically, it looks for command-line arguments that contain all of the following strings: '\local\temp\', '//b /e:jscript', and '.txt'. This pattern suggests the execution of a JScript file from a temporary directory, which is a known behavior of Griffon malware as reported by Kaspersky.
This rule detects the creation of files with the '.dmp', '.dump', or '.hdmp' extensions. These files are typically memory dumps generated by software during a crash. While often legitimate, memory dumps can contain sensitive information, including credentials, which could be exploited by adversaries. The rule aims to identify instances where such files are created to allow for investigation into the cause of the crash and to ensure no sensitive data is exposed or exfiltrated.
This rule detects when the "System.Drawing.ni.dll" library is loaded by a process. This DLL is often used for graphical operations, including screen capturing. Its loading can indicate an attempt to capture screen content, which is a common technique used by adversaries for reconnaissance or data exfiltration.
This rule detects PowerShell scripts that perform potential registry reconnaissance. Specifically, it looks for the use of PowerShell cmdlets like 'Get-Item', 'gci', or 'Get-ChildItem' in conjunction with specific registry paths known to contain system configuration, service information, or autostart entries. Adversaries often query these registry keys to gather information about the system's credentials, configuration, and installed software, which can aid in further compromise or privilege escalation.
This rule detects potentially suspicious child processes spawned by PowerShell. It specifically looks for PowerShell (powershell.exe, powershell_ise.exe, pwsh.exe) launching a set of common Windows utilities that can be abused for malicious purposes, such as 'bitsadmin.exe', 'certutil.exe', 'mshta.exe', 'regsvr32.exe', 'rundll32.exe', 'schtasks.exe', and 'wmic.exe'. The rule includes filters to reduce false positives, such as specific command lines for AWS Workspaces, certutil's '-verifystore' option, and common benign wmic queries.
Detects when an Amazon Simple Email Service (SES) identity is deleted. This action could be performed by an adversary to remove traces of their activities after using the SES identity for malicious purposes, such as sending spam or phishing emails, aligning with defense evasion tactics.
Page 488 of 680