SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,664 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects various obfuscated PowerShell IEX invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for regex patterns in the ImagePath field of Event ID 7045 (Service Creation) that are characteristic of Invoke-Obfuscation's techniques to hide PowerShell commands.
Detects the obfuscated use of clip.exe to execute PowerShell commands. This technique involves creating a new service that uses 'cmd' and 'clip.exe' in conjunction with PowerShell's clipboard functionality to execute code, often as a method of defense evasion.
Detects the creation of a new Windows service where the ImagePath contains either 'Clipboard' or 'i', which could indicate an attempt to obfuscate PowerShell commands using techniques like Invoke-Obfuscation. This rule specifically looks for EventID 7045 from the 'Service Control Manager' provider.
Detects suspicious service installations by monitoring Event ID 7045 from the Service Control Manager. The rule looks for specific command-line patterns in the ImagePath field that are commonly associated with malicious service creation, such as PowerShell download commands, hidden windows, or execution from temporary directories.
Detects Windows services that terminate with an error, which can indicate issues with the service itself, or malicious activity attempting to disrupt or disable services. This rule specifically looks for Event ID 7023 from the 'Service Control Manager' provider.
This rule detects when exclusions are added to Windows Defender. Adversaries often add exclusions to security software to prevent their malicious tools and activities from being detected. This specific rule looks for Event ID 5007, which indicates a change in the antimalware platform configuration, and checks if the new configuration value contains the string '\Microsoft\Windows Defender\Exclusions'. This indicates that a path or file has been added to Windows Defender's exclusion list.
Detects when Windows Defender's Antimalware Scan Interface (AMSI) triggers an alert, indicating that it has detected malware or other potentially unwanted software. This rule specifically looks for Event ID 1116 with the SourceName 'AMSI' from the Windows Defender log source.
Detects the creation of an Alternate Data Stream (ADS) named ':Zone.Identifier' within the WinGet temporary directory, specifically when the ZoneId is '3' (Internet) and the source URL contains suspicious IP address patterns (e.g., '://1', '://2', etc.). This indicates a file downloaded from the internet via WinGet that might originate from an untrusted or suspicious source, potentially used for defense evasion or persistence.
Detects the creation of an "Active Directory Schema Cache File" (.sch) by an uncommon process. This activity can be indicative of tools performing Active Directory-related operations, potentially for reconnaissance or command and control, such as LDAPFragger. The rule filters out common legitimate processes that create these files.
Detects the creation of specific files commonly associated with Mimikatz, a credential dumping tool. Specifically, it looks for files ending with '.kirbi' (Kerberos tickets) or named 'mimilsa.log' (related to MemSSP). This activity often indicates an attempt to steal Kerberos credentials or other sensitive authentication information.
Page 485 of 680