SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,492 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the ld.so preload persistence file. See `man ld.so` for more information.
Detects disabling security tools
Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log files and directories.
Adversaries often try to clear logs to cover their tracks after performing malicious activities.
Adversaries often try to clear logs to cover their tracks after performing malicious activities.
Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system
Detects the use of Python's base64 decoding functions in command line executions on Linux systems.
Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
Detect file time attribute change to hide new or changes to existing files
Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
Show when private keys are being exported from the device, or when new certificates are installed
Turn off logging locally or remote
Detects Bitsadmin connections to IP addresses instead of FQDN names
Page 64 of 680