Rule Library

Sigma Rules

125 rules found for "Florian Roth (Nextron Systems)"

3,707Total
3,116Detection
451Emerging
137Hunting
Emerging Threathightest

Possible Exploitation of Exchange RCE CVE-2021-42321

Detects log entries that appear in exploitation attempts against MS Exchange RCE CVE-2021-42321

Windowsmsexchange-management
TA0008 · Lateral MovementT1210 · Exploitation of Remote Servicesdetection.emerging-threats
Florian Roth (Nextron Systems)Thu Nov 182021
Emerging Threatcriticaltest

Grafana Path Traversal Exploitation CVE-2021-43798

Detects a successful Grafana path traversal exploitation

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2021-43798detection.emerging-threats
Florian Roth (Nextron Systems)Wed Dec 082021
Emerging Threathightest

Log4j RCE CVE-2021-44228 Generic

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 (Log4Shell)

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationdetection.emerging-threats
Florian Roth (Nextron Systems)Fri Dec 102021
Emerging Threathightest

Log4j RCE CVE-2021-44228 in Fields

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2021-44228detection.emerging-threats
Florian Roth (Nextron Systems)Fri Dec 102021
Emerging Threathightest

Exchange ProxyShell Pattern

Detects URL patterns that could be found in ProxyShell exploitation attempts against Exchange servers (failed and successful)

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationdetection.emerging-threats
Florian Roth (Nextron Systems)+1Sat Aug 072021
Emerging Threatcriticaltest

Successful Exchange ProxyShell Attack

Detects URP patterns and status codes that indicate a successful ProxyShell exploitation attack against Exchange servers

Web Server Log
TA0001 · Initial Accessdetection.emerging-threats
Florian Roth (Nextron Systems)+1Mon Aug 092021
Emerging Threathightest

Suspicious RazerInstaller Explorer Subprocess

Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM

WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1553 · Subvert Trust Controlsdetection.emerging-threats
Florian Roth (Nextron Systems)+1Mon Aug 232021
Emerging Threatcriticaltest

Potential SystemNightmare Exploitation Attempt

Detects an exploitation attempt of SystemNightmare in order to obtain a shell as LOCAL_SYSTEM

WindowsProcess Creation
TA0004 · Privilege EscalationT1068 · Exploitation for Privilege Escalationdetection.emerging-threats
Florian Roth (Nextron Systems)Wed Aug 112021
Emerging Threathightest

SonicWall SSL/VPN Jarrewrite Exploitation

Detects exploitation attempts of the SonicWall Jarrewrite Exploit

Web Server Log
T1190 · Exploit Public-Facing ApplicationTA0001 · Initial Accessdetection.emerging-threats
Florian Roth (Nextron Systems)Mon Jan 252021
Emerging Threathightest

Potential BlackByte Ransomware Activity

Detects command line patterns used by BlackByte ransomware in different operations

WindowsProcess Creation
TA0002 · ExecutionTA0005 · Defense EvasionTA0040 · ImpactT1485 · Data Destruction+4
Florian Roth (Nextron Systems)Fri Feb 252021
Emerging Threatcriticaltest

DarkSide Ransomware Pattern

Detects DarkSide Ransomware and helpers

WindowsProcess Creation
TA0002 · ExecutionT1204 · User Executiondetection.emerging-threats
Florian Roth (Nextron Systems)Fri May 142021
Emerging Threatcriticaltest

FoggyWeb Backdoor DLL Loading

Detects DLL hijacking technique used by NOBELIUM in their FoggyWeb backdoor. Which loads a malicious version of the expected "version.dll" dll

WindowsImage Load (DLL)
TA0042 · Resource DevelopmentT1587 · Develop Capabilitiesdetection.emerging-threats
Florian Roth (Nextron Systems)Mon Sep 272021
Emerging Threatcriticaltest

HAFNIUM Exchange Exploitation Activity

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

WindowsProcess Creation
TA0004 · Privilege EscalationTA0002 · ExecutionTA0003 · PersistenceT1546 · Event Triggered Execution+3
Florian Roth (Nextron Systems)Tue Mar 092021
Emerging Threathightest

Exchange Exploitation Used by HAFNIUM

Detects exploitation attempts in Exchange server logs as described in blog posts reporting on HAFNIUM group activity

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing ApplicationG0125 · HAFNIUMdetection.emerging-threats
Florian Roth (Nextron Systems)Wed Mar 032021
Emerging Threatcriticaltest

REvil Kaseya Incident Malware Patterns

Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)

WindowsProcess Creation
TA0002 · ExecutionT1059 · Command and Scripting InterpreterG0115 · G0115detection.emerging-threats
Florian Roth (Nextron Systems)Sat Jul 032021
Emerging Threathightest

APT PRIVATELOG Image Load Pattern

Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

WindowsImage Load (DLL)
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1055 · Process Injectiondetection.emerging-threats
Florian Roth (Nextron Systems)Tue Sep 072021
Emerging Threathightest

DEWMODE Webshell Access

Detects access to DEWMODE webshell as described in FIREEYE report

Web Server Log
TA0003 · PersistenceT1505.003 · Web Shelldetection.emerging-threats
Florian Roth (Nextron Systems)Mon Feb 222021
Emerging Threathightest

CVE-2022-24527 Microsoft Connected Cache LPE

Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache

WindowsFile Event
TA0002 · ExecutionTA0004 · Privilege EscalationT1059.001 · PowerShellcve.2022-24527+1
Florian Roth (Nextron Systems)Wed Apr 132022
Emerging Threathightest

Potential CVE-2022-26809 Exploitation Attempt

Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)

WindowsProcess Creation
TA0001 · Initial AccessT1190 · Exploit Public-Facing ApplicationTA0002 · ExecutionT1569.002 · Service Execution+2
Florian Roth (Nextron Systems)Wed Apr 132022
Emerging Threathightest

Potential KDC RC4-HMAC Downgrade Exploit - CVE-2022-37966

Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation

Windowssystem
TA0004 · Privilege Escalationdetection.emerging-threatscve.2022-37966
Florian Roth (Nextron Systems)Wed Nov 092022
Emerging Threathightest

Suspicious Sysmon as Execution Parent

Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)

WindowsProcess Creation
TA0004 · Privilege EscalationT1068 · Exploitation for Privilege Escalationcve.2022-41120detection.emerging-threats
Florian Roth (Nextron Systems)+1Thu Nov 102022
Emerging Threathightest

Hermetic Wiper TG Process Patterns

Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

WindowsProcess Creation
TA0002 · ExecutionTA0008 · Lateral MovementT1021.001 · Remote Desktop Protocoldetection.emerging-threats
Florian Roth (Nextron Systems)Fri Feb 252022
Emerging Threathightest

MERCURY APT Activity

Detects suspicious command line patterns seen being used by MERCURY APT

WindowsProcess Creation
TA0002 · ExecutionT1059.001 · PowerShellG0069 · G0069detection.emerging-threats
Florian Roth (Nextron Systems)Fri Aug 262022
Emerging Threatmediumtest

Potential CVE-2023-2283 Exploitation

Detects potential exploitation attempt of CVE-2023-2283 an authentication bypass in libSSH. The exploitation method causes an error message stating that keys for curve25519 could not be generated. It is an error message that is a sign of an exploitation attempt. It is not a sign of a successful exploitation.

Linuxsshd
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2023-2283detection.emerging-threats
Florian Roth (Nextron Systems)Fri Jun 092023
Emerging Threathightest

Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity

Detects file indicators of potential exploitation of MOVEit CVE-2023-34362.

WindowsFile Event
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2023-34362detection.emerging-threats
Florian Roth (Nextron Systems)+1Thu Jun 012023
Emerging Threathightest

Potential Exploitation Attempt Of Undocumented WindowsServer RCE

Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)

WindowsProcess Creation
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationdetection.emerging-threats
Florian Roth (Nextron Systems)+1Sat Jan 212023
Emerging Threathightest

Qakbot Uninstaller Execution

Detects the execution of the Qakbot uninstaller file mentioned in the USAO-CDCA document on the disruption of the Qakbot malware and botnet

WindowsProcess Creation
TA0002 · Executiondetection.emerging-threats
Florian Roth (Nextron Systems)Thu Aug 312023
Emerging Threathightest

Potential Operation Triangulation C2 Beaconing Activity - DNS

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

dns
TA0011 · Command and ControlG0020 · G0020detection.emerging-threats
Florian Roth (Nextron Systems)Thu Jun 012023
Emerging Threathightest

Potential Operation Triangulation C2 Beaconing Activity - Proxy

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Proxy Log
TA0011 · Command and ControlG0020 · G0020detection.emerging-threats
Florian Roth (Nextron Systems)Thu Jun 012023