SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,614 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet to enumerate local group memberships, specifically looking for common administrative or privileged groups. This activity is often performed by attackers during the discovery phase to identify potential privilege escalation paths or valuable targets.
Detects the installation of a Microsoft Exchange Transport Agent by monitoring for the 'Install-TransportAgent' command-line argument. This activity can be used by adversaries to establish persistence on Exchange servers.
Detects non-interactive PowerShell activity by identifying PowerShell processes (powershell.exe or pwsh.exe) that are not spawned by typical user-facing graphical interface processes such as explorer.exe. This rule aims to identify PowerShell execution that is not directly initiated by a user through interactive means, potentially indicating automated or malicious activity. It includes filters for known legitimate parent processes like those associated with Windows updates, VS Code, and Windows Terminal to reduce false positives.
This rule detects suspicious PowerShell scripts attempting to copy the Security Account Manager (SAM) database. It specifically looks for PowerShell command lines that include both a reference to a volume shadow copy (e.g., '\HarddiskVolumeShadowCopy') and the SAM file path ('System32\config\sam'), combined with common PowerShell copy commands or .NET file copy methods. This activity is indicative of an adversary trying to extract credentials by accessing the SAM database, often from a shadow copy to bypass file locks.
This rule detects suspicious invocations of PowerShell or PowerShell Core (pwsh.exe) when the parent process is a script engine like wscript.exe or cscript.exe. This behavior is often associated with adversaries using scripting languages to execute PowerShell commands, potentially bypassing direct PowerShell execution policies or obfuscating their activities. The rule specifically filters out legitimate activity from 'Health Service State' to reduce false positives.
Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual". This activity can be indicative of an adversary attempting to impair defenses or achieve persistence by modifying service configurations.
This rule detects suspicious PowerShell command-line patterns indicative of downloading and executing remote content. Specifically, it looks for the use of `IEX (New-Object Net.WebClient).DownloadString` or `(New-Object System.Net.WebClient).DownloadFile` which are commonly abused by malicious scripts, stagers, and downloaders to fetch and run payloads from the internet.
Detects PowerShell command line contents that include suspicious abnormal casing in the 'Net.Webclient' string (e.g., 'nEt.WEbCliEnT') as used in obfuscation techniques. This rule specifically looks for base64 encoded variations of 'Net.Webclient' with mixed casing, indicating an attempt to evade detection.
Detects the use of the PowerShell Get-ADUser cmdlet to enumerate Active Directory user information and export it to a file or pipe it to other cmdlets for further processing, which can be indicative of reconnaissance or data staging by an attacker.
Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files and bypass application allowlisting.
Page 567 of 680