SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,619 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects specific combinations of encoding methods in PowerShell via the commandline, looking for patterns indicative of obfuscation techniques used to hide malicious PowerShell commands. This rule specifically targets the use of 'ToInt', 'ToDecimal', 'ToByte', 'ToUint', 'ToSingle', 'ToSByte', 'ToChar', 'ToString', 'String' in conjunction with PowerShell executables, or combinations of 'char' and 'join', or 'split' and 'join' in the command line.
This rule detects attempts to execute PowerShell code inline from a file. It specifically looks for command-line arguments that combine PowerShell execution commands like 'iex', 'Invoke-Expression', 'Invoke-Command', or 'icm' with file reading commands such as 'cat', 'get-content', or 'type', along with the '-raw' parameter. This combination suggests that a file's content is being read and then immediately executed as PowerShell code.
Detects the execution of the 'Get-Clipboard' PowerShell cmdlet via the command line interface. This cmdlet is used to retrieve the current content of the clipboard, which could be leveraged by adversaries for data collection.
Detects the use of the "Set-Service" PowerShell cmdlet to modify a service's Security Descriptor Definition Language (SDDL) to hide the service from standard enumeration utilities like "sc.exe" or "Get-Service". This technique leverages specific SDDL flags (DCLCWPDTSD) to restrict access and visibility, primarily effective in PowerShell 7 environments.
Detects PowerShell execution using the `Set-Acl` cmdlet to modify the Access Control List (ACL) of a file or folder. This can be used by adversaries to change permissions, potentially granting themselves or other users/groups unauthorized access or denying access to legitimate users/services as a form of defense evasion or impact.
Detects the use of X509Enrollment COM objects or their associated CLSID in process command lines. This can be indicative of attempts to manipulate certificates, potentially for defense evasion or to establish trust for malicious purposes, such as installing root certificates.
Detects PowerShell scripts that use the "Compress-Archive" Cmdlet to compress folders and files, storing the output in potentially suspicious locations often used by malware for exfiltration. This activity indicates an adversary might be compressing collected data (e.g., sensitive documents) prior to exfiltration to make it portable and minimize network data transfer.
Detects the use of 'PresentationHost.exe', a utility designed to run '.xbap' (Browser Applications) files, when it attempts to download arbitrary files from HTTP, HTTPS, or FTP sources. This behavior can be abused for defense evasion and execution of malicious content.
This rule detects attempts to abuse the `print.exe` utility for remote file copy operations. Attackers can leverage `print.exe`, a legitimate Windows binary, to transfer files by specifying a remote destination using the `/D` switch and a file with an `.exe` extension. This technique is often used for defense evasion by proxying execution with a trusted system binary.
This rule detects when `Microsoft.NodejsTools.PressAnyKey.exe` spawns a child process. This executable is part of Visual Studio's Node.js tools and is designed to pause execution until a key is pressed. However, it can be abused to proxy the execution of arbitrary binaries, allowing an attacker to bypass certain security controls or execute malicious code under the guise of a legitimate Visual Studio component.
Page 554 of 680