SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,619 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout
Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines
Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell script commands
Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers
Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features
Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0
Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool.
Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)
Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.
Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages
Page 131 of 680