SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,631 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.
Detects PowerShell commands or scripts that attempt to disable the command history by removing the 'psreadline' module. This action is often performed by adversaries to evade detection and hinder forensic analysis by preventing their commands from being logged.
Detects the usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" with the '-Online' parameter to enable specific Windows optional features. This cmdlet is similar to DISM.exe and can be used to enumerate, install, uninstall, configure, and update features and packages in Windows images. The rule specifically looks for the enabling of potentially suspicious features like Telnet Server, Internet Explorer, TFTP Client, SMB1 Protocol, Client-ProjFS, and Microsoft-Windows-Subsystem-Linux.
Detects the usage of the PowerShell `Set-Mailbox` cmdlet to configure an SMTP forwarding rule for a mailbox. This can be indicative of an adversary setting up automatic email forwarding to an external address for data exfiltration or continued access to communications.
Detects PowerShell script blocks attempting to exfiltrate data using ICMP by creating a System.Net.NetworkInformation.Ping object and sending data. This method allows adversaries to bypass traditional network controls by tunneling data over ICMP.
Detects the use of obfuscated PowerShell commands that leverage STDIN for execution, often associated with tools like Invoke-Obfuscation. The rule specifically looks for patterns where 'cmd' is used to launch PowerShell with input redirection or the 'noexit' parameter, combined with a reference to 'input' or 'noexit' within the script block text.
Detects the execution of PowerShell scripts containing patterns commonly associated with Mimikatz, a tool used for dumping credentials. The rule looks for specific strings related to Mimikatz functionalities like 'DumpCreds', 'DumpCerts', 'sekurlsa::logonpasswords', and 'crypto::certificates' in conjunction with 'CERT_SYSTEM_STORE_LOCAL_MACHINE'.
This rule detects PowerShell script blocks that contain keywords associated with collecting local email data, specifically targeting Microsoft Outlook. It looks for script names like 'Get-Inbox.ps1' or the use of Outlook COM objects ('Microsoft.Office.Interop.Outlook', 'Microsoft.Office.Interop.Outlook.olDefaultFolders', '-comobject outlook.application'). This activity is indicative of an adversary attempting to gather sensitive information from a user's local email client.
Detects attempts to modify a PowerShell user profile using the `Add-Content` cmdlet to inject suspicious commands. This technique can be used for persistence, as the injected commands will execute every time a PowerShell session starts for that user.
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass. This technique is often used to extract credentials.
Page 526 of 680