SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,479 copies16 likes159,606 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014
Detects Obfuscated use of stdin to execute PowerShell
Detects Obfuscated use of Environment Variables to execute PowerShell
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects Obfuscated Powershell via Stdin in Scripts
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects Obfuscated Powershell via use MSHTA in Scripts
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts.
This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
Page 111 of 680