SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,622 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects attempts to clear PowerShell command history, which adversaries might do to remove traces of their activities. It looks for specific PowerShell commands and keywords related to deleting history files or configuring PowerShell to not save history. This includes commands like 'del', 'Remove-Item', 'rm' in conjunction with the PowerShell history path, or setting 'Set-PSReadlineOption -HistorySaveStyle SaveNothing'.
This rule detects attempts to dump credentials from the Windows Credential Manager using PowerShell. It specifically looks for the use of known PowerShell functions or code patterns associated with credential dumping tools or techniques. This includes functions like 'Get-PasswordVaultCredentials' and 'Get-CredManCreds', as well as the instantiation of .NET objects related to 'Windows.Security.Credentials.PasswordVault' or specific CSharpCodeProvider patterns often used in reflective loading or dynamic compilation for credential access.
Detects the usage of `[Reflection.Assembly]::load` functions within PowerShell script block logs. This method allows for dynamically loading assemblies into memory, which can be used by adversaries to execute malicious code without writing it to disk, thus evading traditional file-based detections.
This rule detects attempts to enumerate credentials from the Windows Credential Manager using PowerShell. It specifically looks for PowerShell script block text containing both 'vaultcmd' and '/listcreds:', combined with keywords like 'Windows Credentials' or 'Web Credentials'. This activity is indicative of an adversary trying to obtain stored user credentials.
This rule detects the execution of a PowerShell command that specifically enumerates browser bookmarks. It looks for the use of 'Get-ChildItem' with parameters '-Recurse', '-Path', '-Filter Bookmarks', '-ErrorAction SilentlyContinue', and '-Force'. This activity is indicative of an adversary attempting to discover information about the compromised host by collecting browser bookmark data, which can reveal personal information or details about internal network resources.
This rule detects the use of the 'Get-AdGroup' PowerShell cmdlet with the '-Filter' parameter to enumerate groups within Active Directory. This activity is often performed by attackers during the discovery phase to identify privileged groups and users.
This rule detects the execution of the Invoke-DNSExfiltrator PowerShell cmdlet, which is used for exfiltrating data over a DNS request covert channel. The detection specifically looks for the presence of the cmdlet name along with common parameters such as '-i', '-d', '-p', '-doh', and '-t', indicating an attempt to use the DNSExfiltrator tool.
Detects PowerShell script block logging (Event ID 4104) entries that indicate the use of Invoke-Obfuscation's COMPRESS obfuscation technique. This technique typically involves using 'new-object' with 'text.encoding::ascii' and 'system.io.compression.deflatestream' or 'system.io.streamreader' followed by 'readtoend' to decompress and execute obfuscated code.
This rule detects the execution of PowerShell commandlets and functions associated with the Nishang exploitation framework. Nishang is a collection of PowerShell scripts and functions that enable penetration testers to use PowerShell for offensive security tasks. The rule specifically looks for a comprehensive list of known Nishang commandlet names and arguments within PowerShell script block logs. Detection of these strings indicates potential malicious activity, including credential dumping, persistence mechanisms, exfiltration, and remote code execution.
Detects the execution of PowerShell cmdlets associated with PowerView, a reconnaissance tool within the PowerSploit framework. This rule specifically looks for a comprehensive list of PowerView cmdlets within PowerShell script block logs, indicating potential adversary activity related to discovery and information gathering in an Active Directory environment.
Page 549 of 680