SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,506 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects activity that could be related to Baby Shark malware, specifically looking for command-line patterns indicative of its execution and discovery techniques. This includes the use of mshta.exe to execute HTA files via PowerShell, querying the registry for Terminal Server Client information, and using PowerShell to upload files.
Detects LockerGoga ransomware activity by identifying a specific command-line argument pattern used by the malware. The rule looks for the string '-i SM-tgytutrc -s' within process command lines, which is a known indicator of LockerGoga execution.
Detects potential BlueMushroom DLL loading activity via regsvr32 from the AppData Local directory. This technique is often used for defense evasion and execution of malicious code.
Detects exploitation attempts targeting the TerraMaster TOS vulnerability CVE-2020-28188. This rule specifically looks for GET requests to '/include/makecvs.php' with a '?Event=' parameter, combined with common command injection payloads such as 'curl', 'wget', '.py', '.sh', 'chmod', or '_GET' in the URI query.
Detects the exploitation of the Microsoft Exchange ProxyToken vulnerability (CVE-2021-33766), which is an authentication bypass. The rule looks for specific URI query patterns and HTTP POST methods combined with a 500 HTTP status code, indicating a potential exploitation attempt against the Exchange Control Panel (ECP) or related services.
Detects patterns indicative of the exploitation of the Serv-U CVE-2021-35211 vulnerability, specifically looking for the execution of 'whoami' in conjunction with specific file paths related to the Serv-U client. This activity has been associated with the threat group DEV-0322.
Detects the creation of ".xml" and ".txt" files in folders within the "\AppData\Roaming\Microsoft" directory by specific uncommon processes. This behavior is associated with Devil Bait malware samples and stages as described by the NCSC.
Detects potential exploitation attempts targeting the Cacti Command Injection vulnerability, CVE-2022-46169. The rule looks for specific patterns in GET requests to '/remote_agent.php' with 'action=polldata' and 'poller_id=' in the query, combined with suspicious command injection payloads like 'base64 -d | /bin/bash', 'whoami', 'powershell', 'cmd', or 'wget'.
Detects the execution of renamed 'cmd', 'powershell', or 'powershell_ise' binaries to 'wermgr.exe'. This technique has been observed in the exploitation of CVE-2023-36874, where attackers disguise legitimate system binaries to evade detection.
Detects the creation of a file named "dllhost.exe" in the "C:\users\public\Documents\" directory, which has been observed as an indicator for the COLDSTEEL RAT malware.
Page 510 of 680