SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,634 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule identifies attempts to clear the PowerShell console history. Adversaries often clear command history to remove traces of their activities on a compromised system, making forensic analysis more difficult. The rule specifically looks for the 'Clear-History' cmdlet or the deletion of the 'ConsoleHost_history.txt' file, which stores PowerShell command history.
This rule detects the installation of a root certificate on a Windows system via PowerShell. It specifically looks for PowerShell script block text containing commands like 'Move-Item' or 'Import-Certificate' targeting the 'Cert:\LocalMachine\Root' path. Adversaries may install root certificates to bypass security warnings when connecting to their controlled web servers, facilitating man-in-the-middle attacks or credential harvesting.
Detects PowerShell scripts attempting to modify Access Control Lists (ACLs) on files or directories within the Windows system folders. This activity is suspicious as it can be used by adversaries to gain persistence, elevate privileges, or evade defenses by modifying critical system file permissions.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify the Security Descriptor (DACL) of a Windows service. This modification can be used by adversaries to hide a service from standard enumeration tools like 'sc.exe' or 'Get-Service', aiding in defense evasion and persistence. This technique is noted to be effective in PowerShell 7 and later versions.
This rule detects the execution of the PowerShell cmdlet `Get-SmbShare`. Adversaries often use this cmdlet to discover shared folders and drives on remote systems, which can help them identify valuable information for collection or potential targets for lateral movement. This activity is a common precursor to further reconnaissance and exploitation within a network.
This rule detects the usage of the PowerShell cmdlet `Test-NetConnection` to probe network connectivity to a specified computer name and port, specifically looking for connections to ports other than the commonly used 80 or 443. This behavior can indicate an adversary attempting to establish or test communication channels over non-standard ports, potentially to bypass network defenses or obscure command and control activities.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify a service's security descriptor (SDDL) to include 'DCLCWPDTSD'. This specific SDDL string is known to hide services from common utilities like 'sc.exe' and 'Get-Service', effectively making them invisible. This technique is primarily effective in PowerShell 7 and later versions.
Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class. This method can be used for defense evasion by leveraging a trusted system utility (PowerShell) and a legitimate WMI class to install software, potentially bypassing traditional application whitelisting or execution policies.
Detects attempts to access the LSASS process memory by tools or processes that have the keyword "dump" in their image name. This behavior is indicative of credential dumping activities, where adversaries try to extract sensitive information like passwords and hashes from the LSASS process.
This rule detects the use of the `attrib.exe` utility to hide files by setting the hidden attribute (`+h`). Adversaries often use this technique to conceal malicious files or directories from users and basic forensic analysis, aiding in defense evasion. The rule specifically looks for the execution of `attrib.exe` with the `+h` command-line argument.
Page 519 of 680