SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,623 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects usage of PowerShell cmdlets to disable or remove Event Tracing for Windows (ETW) trace sessions. This activity can be an attempt by an adversary to impair defenses by blocking or removing indicators that would normally be collected by security monitoring tools.
Detects PowerShell script blocks that contain commands used to export certificates from the local certificate store. This activity can be abused by threat actors to steal private keys from compromised machines.
This rule detects PowerShell scripts that attempt to import modules from suspicious directories such as the user's temporary folder ($Env:Temp), application data folder ($Env:Appdata), or the C:\Users\Public\ directory. Adversaries often use these locations to drop and execute malicious PowerShell modules to evade detection or achieve persistence.
Detects obfuscated PowerShell scripts that utilize 'mshta' for execution, often seen in defense evasion tactics. The rule specifically looks for a combination of keywords in PowerShell script block logs, indicating the use of 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)' which are characteristic of Invoke-Obfuscation techniques involving MSHTA.
This rule detects PowerShell script execution that attempts to enumerate installed software on a Windows system. Specifically, it looks for the combination of `Get-ItemProperty`, `\software\`, `Select-Object`, and `Format-Table` within the PowerShell script block text. This pattern is commonly used to query the registry for installed applications under `HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\` and format the output.
This rule detects PowerShell commands that attempt to store data in an Alternate Data Stream (ADS) by redirecting the output of a command executed via `cmd.exe` (comspec) into a file using the `>` operator. This technique is often used by malware, such as Astaroth, to hide malicious data within legitimate files, making it harder to detect.
This rule detects the execution of PowerShell cmdlets related to 'TroubleshootingPack' with specific arguments, which could indicate an attempt to leverage vulnerabilities like CVE-2022-30190 (Follina) or similar techniques used by the 'msdt' LOLBIN (Living Off the Land Binaries). The detection specifically looks for the combination of 'Invoke-TroubleshootingPack', the path 'C:\Windows\Diagnostics\System\PCW', '-AnswerFile', and '-Unattended' within the PowerShell script block text. This pattern is indicative of an attempt to execute diagnostic packages in an unattended manner, often exploited for arbitrary code execution.
Detects PowerShell scripts that use the System.Net.WebClient class to download files or strings from the internet. This is a common technique used by adversaries to retrieve malicious payloads or additional tools.
Detects PowerShell code that uses `GetTypeFromCLSID` in conjunction with `.ShellExecute(` to execute COM objects. This technique can be used for persistence or privilege escalation by adversaries.
This rule detects PowerShell scripts attempting to open a handle to a drive volume using the `IO.FileStream` object and the `\\.\` DOS device path specifier. This technique is often used for direct access to the volume, bypassing standard file system controls.
Page 540 of 680