SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,492 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity
Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets.
Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.
Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.
Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a potential attempt to setup a reverse shell
Detects usage of system utilities (only grep and egrep for now) to discover security software discovery
Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem
Detects a suspicious curl process start on linux with set useragent options
Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity
Detects java process spawning suspicious children
Page 605 of 680