SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,618 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects PowerShell commands that attempt to discover sensitive files by looking for common file extensions associated with credentials or password managers (e.g., .pass, .kdbx, .kdb). It specifically targets commands like 'ls', 'get-childitem', or 'gci' combined with the '-recurse' parameter, indicating a recursive search for these sensitive file types.
Detects PowerShell script blocks that manipulate security descriptors using specific WMI classes and properties (win32_Trustee, win32_Ace, .AccessMask, .AceType, .SetSecurityDescriptor) in conjunction with specific LSA registry paths (Lsa\JD, Lsa\Skew1, Lsa\Data, Lsa\GBG). This combination is indicative of potential persistence mechanisms, as seen in projects like DAMP, which aim to backdoor systems by modifying security settings to maintain access or elevate privileges.
This rule detects the execution of a PowerShell command containing 'Get-Process lsass' within a script block. This command is commonly used by attackers to identify the LSASS process ID before attempting to dump its memory for credential harvesting. The detection relies on PowerShell Script Block Logging being enabled.
Detects PowerShell scripts that create TCP listeners and accept client connections, which is indicative of tunneling activity. The rule specifically looks for the use of '[System.Net.HttpWebRequest]', 'System.Net.Sockets.TcpListener', and 'AcceptTcpClient' within the script block text.
This rule detects PowerShell script execution where the 'WindowStyle Hidden' option is used. Adversaries often use this technique to conceal malicious activity from users by preventing the PowerShell window from being visible. The rule specifically looks for the combination of 'powershell', 'WindowStyle', and 'Hidden' within the script block text. A filter is applied to exclude legitimate Amazon WorkSpaces configuration scripts that use this option.
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file. This activity is often associated with reconnaissance phases where attackers enumerate Active Directory users for further targeting.
Detects suspicious access to the Local Security Authority Subsystem Service (LSASS) process memory. This rule specifically looks for access to 'lsass.exe' originating from 'svchost.exe' with a specific suspicious access right ('0x14c0') and a call trace indicating 'seclogon.dll'. This combination suggests an attempt to dump LSASS memory, potentially to steal credentials.
Detects a possible process memory dump of LSASS using processes with whitelisted filenames (like TrolleyExpress.exe, ProcessDump.exe, dump64.exe) to evade detection by security products like Microsoft Defender. The rule specifically looks for access to lsass.exe with granted access rights commonly associated with memory dumping.
Detects suspicious access to the "svchost" process with a high level of granted access (0x1F3FFF) and an unknown call trace. This behavior is often associated with techniques like those used by Invoke-Phantom to terminate critical system processes, such as the Windows event logging service, to evade detection. The rule filters out legitimate MSBuild activity that might exhibit similar call trace characteristics.
Detects the execution of the Add-In deployment cache updating utility (AddInUtil.exe) when it is used with suspicious AddInRoot or PipelineRoot paths. Adversaries may leverage this legitimate utility to load their malicious add-ins by pointing to uncommon or user-controlled directories like temporary folders, desktop, downloads, or public user directories. This technique can be used for defense evasion by proxying execution through a trusted binary.
Page 560 of 680