hightestEmerging Threat
Potential Conti Ransomware Database Dumping Activity Via SQLCmd
Detects a command used by conti to dump database
windowsprocess_creation
2023-05-04
Rule Library
Sigma Rules
Browse detections by severity and log source, with YAML and sample events one click away.
3,782Total
3,164Detection
474Emerging
141Hunting
criticaltestEmerging Threat
Griffon Malware Attack Pattern
Detects process execution patterns related to Griffon malware as reported by Kaspersky
windowsprocess_creation
2023-03-09
highexperimentalEmerging Threat
TeamPCP LiteLLM Supply Chain Attack Persistence Indicators
Detects the creation of specific persistence files as observed in the LiteLLM PyPI supply chain attack. In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP. The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.
linuxfile_event
2026-03-30
highexperimentalEmerging Threat
LiteLLM / TeamPCP Supply Chain Attack Indicators
Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8). In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP. The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.
linuxprocess_creation
2026-03-30