SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,627 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the creation of a new PowerShell remote session using the 'New-PSSession' cmdlet, specifically when targeting a remote computer via the '-ComputerName' parameter. This activity can be indicative of an adversary establishing remote access or moving laterally within a network.
Detects PowerShell module creation where the module contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This is indicative of potential abuse of the "RemoteFXvGPUDisablement.exe" binary, which is known to be vulnerable to module load-order hijacking. This technique can be used for defense evasion and proxy execution.
This rule detects the execution of the PowerShell cmdlet 'Get-GPO'. This cmdlet is used to retrieve information about Group Policy Objects (GPOs) in a domain. Adversaries may use this for discovery purposes to understand the domain's policy configurations, which can aid in identifying potential privilege escalation paths or misconfigurations.
This rule detects the use of `Start-Process` with the `-PassThru` and `-FilePath` parameters in PowerShell script blocks. The `-PassThru` parameter allows `Start-Process` to return a process object, which can be used to interact with the started process in the background, potentially for stealthy execution or to bypass interactive prompts. The `-FilePath` parameter specifies the executable to run. This combination can be indicative of an adversary attempting to execute a process in a less conspicuous manner.
This rule detects attempts to change the desktop wallpaper using PowerShell. It specifically looks for PowerShell script block text that either modifies the 'WallPaper' property within the 'HKEY_CURRENT_USER\Control Panel\Desktop\' registry key or calls the 'SystemParametersInfo' function with specific parameters (20, 0, *, 3), which is a Windows API call used to set the desktop wallpaper. This activity is indicative of an adversary attempting to deface a system.
Detects PowerShell scripts that utilize the "Compress-Archive" cmdlet to compress folders and files, storing the output in common temporary directories often used by adversaries for data staging prior to exfiltration. This behavior is indicative of an adversary preparing collected data for exfiltration by archiving it to minimize size and make it portable.
Detects the execution of the `AgentExecutor.exe` binary when it is used to execute PowerShell scripts. This binary can be abused as a Living Off The Land Binary (LOLBIN) to run PowerShell scripts with the ExecutionPolicy set to "Bypass" or to execute any binary named "powershell.exe" located in a path provided as the 6th positional argument. The rule specifically looks for `AgentExecutor.exe` being executed with command-line arguments indicating PowerShell script execution, such as `-powershell` or `-remediationScript`. It filters out legitimate usage where the parent process is `Microsoft.Management.Services.IntuneWindowsAgent.exe`.
Detects the usage of `attrib.exe` with the `+s` option to set scripts or executables located in suspicious directories as system files. This technique is used to hide files from users and prevent them from being easily deleted. The rule specifically targets common suspicious locations and file extensions to reduce false positives.
This rule detects potential malicious and unauthorized usage of 'bcdedit.exe' by monitoring process creation events. Specifically, it looks for 'bcdedit.exe' being executed with command-line arguments related to deleting boot entries or values, importing boot data, or enabling safe boot with network capabilities. Such commands can be indicative of ransomware attempting to tamper with the Master Boot Record (MBR) or other boot configurations to prevent system startup or establish persistence, or other forms of bootkit activity.
Detects uncommon child processes spawned by 'BgInfo.exe' or 'BgInfo64.exe'. This behavior can indicate an adversary abusing BgInfo, a legitimate Microsoft utility, to proxy execution of malicious code, potentially via external VBScript, as part of defense evasion or execution tactics.
Page 533 of 680