SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects usage of the 'chattr' utility to remove immutable file attribute.
Detects chmod targeting files in sensitive directory paths on Linux systems.
Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.
Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.
Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks
Detects usage of the 'crontab' utility to remove the current crontab.
This is a common occurrence where cryptocurrency miners compete against each other by removing traces of other miners to hijack the maximum amount of resources possible
This is a common occurrence where cryptocurrency miners compete against each other by removing traces of other miners to hijack the maximum amount of resources possible
Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.
Detects installation of suspicious packages using system installation utilities
Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic
Connection Proxy
Sigma
Detects setting proxy configuration
Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".
Setuid and Setgid
Sigma
Detects suspicious change of file privileges with chown and chmod commands
Page 92 of 680