SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,479 copies16 likes159,604 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects attempts to disable the Windows Firewall using PowerShell. It specifically looks for PowerShell process creations that include commands to set the NetFirewallProfile to 'False' for any profile ('All', 'Public', 'Domain', or 'Private'). This activity is often performed by adversaries to bypass host-based firewalls and facilitate further malicious activity.
This rule detects attempts to disable Windows Defender's security monitoring features using PowerShell or the 'sc.exe' utility. Specifically, it looks for PowerShell commands that include '-DisableBehaviorMonitoring $true' or '-DisableRuntimeMonitoring $true'. It also identifies 'sc.exe' commands used to stop, delete, or disable the 'WinDefend' service (Windows Defender Antivirus Service). This activity is indicative of an adversary trying to impair defenses to avoid detection.
Detects the usage of COM objects within PowerShell commands that can be leveraged to download files. This rule specifically looks for the `[Type]::GetTypeFromCLSID(` method combined with known Class IDs (CLSIDs) associated with objects capable of file downloads.
This rule detects the use of PowerShell's `Get-Process` cmdlet or its aliases (`ps`, `gps`) specifically targeting the `lsass` process. Accessing the `lsass` process memory is a common technique used by attackers to dump credentials, making this activity highly suspicious and indicative of potential credential theft.
Detects PowerShell scripts attempting to import modules from suspicious directories such as temporary folders or publicly accessible user directories. This behavior can indicate an attempt to execute malicious code or evade detection by using non-standard module locations.
Detects the use of PowerShell cmdlets 'Add-AppxPackage' or 'Add-AppPackage' with the '-AllowUnsigned' flag to install unsigned AppX packages. This activity can be indicative of an adversary attempting to establish persistence or evade defenses by installing malicious applications that are not signed by a trusted authority.
Detects attempts to remove or modify Windows Defender configurations using the 'Remove-MpPreference' cmdlet, specifically targeting settings related to Controlled Folder Access and Attack Surface Reduction Rules. This activity is often indicative of an adversary trying to disable security features to facilitate further malicious actions.
Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service". This rule identifies PowerShell processes executing the 'Stop-Service' command, which can be used by adversaries to disrupt services, inhibit incident response, or facilitate data destruction or encryption for impact.
This rule detects the execution of NirCmd with the 'runassystem' command-line argument. NirCmd is a legitimate command-line utility that can be used to perform various tasks, including running commands as the SYSTEM user. Adversaries may abuse this functionality to execute arbitrary commands with elevated privileges, potentially for privilege escalation or to maintain persistence. The detection specifically looks for the ' runassystem ' string in the command line, indicating an attempt to execute a process with SYSTEM privileges using NirCmd.
Detects the execution of the Radmin Viewer utility, which is a legitimate remote administration tool that can be leveraged by adversaries for remote control and lateral movement within a Windows environment.
Page 582 of 680