Suspicious Program Names and Command-Line Arguments

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

This rule detects suspicious patterns in program names or command-line arguments that are commonly associated with malicious samples, hacktools, or exploit kits. It looks for specific keywords and file names in the 'Image' (executable path) and 'CommandLine' fields. Examples include CVE-related strings, common exploit/artifact names like 'poc.exe', 'meterpreter', and various PowerShell scripts often used in post-exploitation such as 'inject.ps1', 'Invoke-CVE', 'mimikatz.ps1', and 'powercat.ps1'.