SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of `iptables` or `ip6tables` commands to flush all firewall rules, tables, and chains, potentially allowing all network traffic. This action is often performed by adversaries to impair defenses and bypass network restrictions.
This rule detects the execution of a script via the SCX RunAsProvider ExecuteScript function, which is associated with the OMIGOD vulnerability. Specifically, it looks for process creation events where the user is 'root', the LogonId is '0', the CurrentDirectory is '/var/opt/microsoft/scx/tmp', and the CommandLine contains '/etc/opt/microsoft/scx/conf/tmpdir/scx'. This pattern indicates the execution of a temporary script created by the SCX agent, often exploited for privilege escalation or initial access.
Detects the use of 'arp -a' or 'ping' commands targeting common private and loopback IP address ranges on Linux systems, which can indicate an adversary performing remote system discovery.
Detects the use of `grep` or `egrep` commands on Linux systems to search for common security software process names. This activity can indicate an adversary attempting to discover installed security solutions on a compromised host.
Detects the creation of a new local user account on macOS systems using either the 'dscl' or 'sysadminctl' commands. Such accounts may be used for persistence without requiring persistent remote access tools.
Detects the use of WebDAV by a client, specifically identifying the 'Microsoft-WebDAV-MiniRedir/' user agent during a GET request. This behavior is often associated with 'DownloadCradle' techniques used by adversaries to download malicious content or exfiltrate data.
Detects attempts to download a Flash Player update from a suspicious, non-official location. This rule specifically looks for requests containing '/flash_install.php' or ending with '/install_flash_player.exe' that do not originate from a legitimate Adobe domain.
Detects HTTP User-Agent strings that end with an equal sign, which can be an indicator of Base64 encoding. This technique is often used by malware to obfuscate C2 communications.
Detects the execution of Sysinternals tools that have been installed via an AppX package. This method of deployment might be used by attackers to bypass detection mechanisms that rely on monitoring standard system paths for these tools.
Detects the creation of a new Background Intelligent Transfer Service (BITS) job by PowerShell. Adversaries may abuse BITS jobs for persistence, execution, or data transfer, and using PowerShell to create these jobs is a common method.
Page 490 of 680