SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,474 copies16 likes159,599 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects a specific UAC bypass technique leveraging Windows Media Player's `osk.exe` by monitoring modifications to a particular registry key. This technique, often associated with UACMe (specifically method 32), involves setting a 'Binary Data' value in the AppCompatFlags\Compatibility Assistant\Store registry path for `C:\Program Files\Windows Media Player\osk.exe`.
Detects when the Windows utility 'Regsvr32.exe' initiates an outbound network connection. This behavior can indicate an attempt to bypass application control or execute malicious code by loading remote COM scriptlets or DLLs, often referred to as 'Squiblydoo'.
Detects the creation of a specific named pipe ('thisispipe') which is known to be used by the DiagTrackEoP Proof-of-Concept tool. This tool exploits the "SeImpersonate" privilege for privilege escalation on Windows systems.
Detects suspicious PowerShell commands that utilize the Net.WebClient object to download files or strings from the internet. This is a common technique used by adversaries for ingress tool transfer or to execute malicious code.
Detects obfuscated use of stdin to execute PowerShell commands, often associated with techniques like Invoke-Obfuscation. The rule specifically looks for patterns in PowerShell module logs (Event ID 4103) where 'cmd' is used with '/c' or '/r' to launch PowerShell, incorporating input from stdin (e.g., using ${input} or noexit).
Detects the use of Invoke-Obfuscation's VAR+ Launcher technique, which leverages obfuscated environment variables to execute PowerShell commands. This technique aims to evade detection by making the command-line arguments difficult to analyze.
This rule detects the execution of the PowerShell cmdlet `Disable-WindowsOptionalFeature` with specific parameters, indicating an attempt to disable Windows optional features. The rule specifically looks for the `-Online` and `-FeatureName` parameters, and then checks for common Windows Defender related feature names. This activity could be part of an adversary's defense evasion tactics to impair security tools.
Detects attempts to change the PowerShell script execution policy to a less secure level (Unrestricted or Bypass) using the `Set-ExecutionPolicy` cmdlet. This action can allow unsigned or untrusted scripts to run, increasing the risk of malicious code execution.
This rule detects PowerShell script blocks that enumerate Active Directory groups or users. Specifically, it looks for the use of `Get-ADPrincipalGroupMembership` to retrieve group memberships or a combination of `Get-ADUser`, filtering (`-f`), property selection (`-pr`), and the `DoesNotRequirePreAuth` attribute, which can be used to identify users with specific authentication properties. Adversaries often perform such discovery to identify privileged accounts or understand the domain structure for further exploitation.
This rule detects potential PowerShell obfuscation techniques where the '-join' operator is used within the '-Value' parameter of 'Set-Alias' or 'New-Alias' cmdlets. This method is often employed by adversaries to hide the true command or object being aliased, making it harder to analyze the script's intent. The rule specifically looks for the combination of '-Alias' and ' -Value (-join(' within PowerShell script block text.
Page 589 of 680