SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,625 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the installation of a root certificate from suspicious locations using PowerShell's `Import-Certificate` cmdlet. Adversaries may install root certificates to bypass security warnings when connecting to their controlled web servers, facilitating man-in-the-middle attacks or credential harvesting. The rule specifically looks for the `Import-Certificate` cmdlet targeting `Cert:\LocalMachine\Root` and originating from common temporary or user-writable directories like `AppData\Local\Temp\`, `Windows\TEMP\`, `Desktop\`, `Downloads\`, `Perflogs\`, or `Users\Public\`.
Detects the use of the PowerShell `New-MailboxExportRequest` cmdlet to export a mailbox to a remote or local share. This activity has been observed in ProxyShell exploitation scenarios, where attackers exfiltrate mailbox data. The rule specifically looks for the cmdlet name, the `-Mailbox` parameter, and the `-FilePath` parameter followed by a UNC path (indicating a share).
Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking. This technique leverages a signed binary to proxy execution of malicious code, specifically by exploiting module load-order hijacking to execute PowerShell commands.
Detects PowerShell script execution from an Alternate Data Stream (ADS). This rule identifies instances where 'powershell.exe' or 'pwsh.exe' is launched, and its command line arguments include 'Get-Content' and '-Stream'. This combination indicates that PowerShell is being used to read and potentially execute content hidden within an Alternate Data Stream, a common technique for defense evasion.
Detects the use of the built-in Windows utility 'query.exe' to extract information about active user sessions or running processes. This activity can be indicative of an attacker performing reconnaissance or staging data for exfiltration.
Detects the usage of 'reg.exe' to dump sensitive registry hives, specifically targeting the SAM, SYSTEM, and SECURITY hives. This activity is indicative of credential dumping attempts.
Detects the usage of 'reg.exe' to query reconnaissance information from the Windows registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software, specifically looking for common persistence mechanisms and service configurations.
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe". This technique leverages a legitimate Windows binary to proxy the execution of malicious commands, often for defense evasion.
Detects modifications or additions to the 'TypedPaths' registry key via the command line, which can indicate an attempt to establish persistence. The 'TypedPaths' key stores recently typed paths in Windows Explorer, and adversaries might manipulate it to execute malicious code when a user accesses certain paths.
Detects execution of regsvr32.exe where the DLL being registered or unregistered is located in a potentially suspicious directory such as temporary folders or public user directories. This technique is often used by adversaries for defense evasion and to bypass application whitelisting.
Page 536 of 680