SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,593 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the execution of PowerShell scripts that contain the 'Get-Process' cmdlet. 'Get-Process' is used to retrieve information about running processes on a local computer. This activity is often performed by adversaries as part of the discovery phase to understand the system's environment and identify potential targets or interesting processes.
Detects the use of the WMI class "Win32_NTEventlogFile" within a PowerShell script to perform suspicious actions such as deleting, backing up, changing permissions, renaming, or taking ownership of event logs. This activity is often associated with defense evasion tactics by adversaries attempting to remove forensic evidence or impair system defenses.
This rule detects the use of WMImplant, a PowerShell-based post-exploitation tool that leverages Windows Management Instrumentation (WMI) for various malicious activities. It specifically looks for keywords and function names associated with WMImplant's capabilities within PowerShell script block logs, such as 'WMImplant', 'change_user', 'command_exec', 'disable_wdigest', 'enable_winrm', 'registry_mod', 'remote_posh', 'sched_job', 'service_mod', 'process_kill', 'active_users', 'basic_info', 'power_off', 'vacant_system', and 'logon_events'. Detection requires PowerShell Script Block Logging to be enabled.
Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign of potential abuse of the binary to proxy execution via a custom Addins.Store payload.
Detects the usage of bitsadmin.exe to download files to uncommon target folders such as AppData or Temp directories. This technique is often used by adversaries for ingress tool transfer or to stage malicious payloads.
Detects the execution of common browser processes (Brave, Chrome, Edge, Opera, Vivaldi) with a command-line argument containing a URL that points to a file with a potentially interesting extension. This behavior can be abused by adversaries to download arbitrary files, potentially for further execution or to hide malicious activity by launching the browser in a minimized state.
Detects suspicious command line execution by `cmd.exe` that includes both a URL (http or https) and the `%AppData%` environment variable in its parameters. This pattern is often observed in droppers, particularly those using JavaScript or VBScript to execute PowerShell commands.
Detects the execution of the built-in "rmdir" command in Windows to delete directories. This activity can be used by adversaries to remove traces of their intrusion activity, such as malware, tools, or other non-native files, to minimize their footprint on a system.
Detects the use of `cmd.exe` to read content from standard input using the `<` redirection operator. This technique can be used by adversaries to execute commands or scripts from a file, effectively piping the file's content as input to `cmd.exe`.
This rule detects the execution of 'curl.exe' to download files from a direct IP address, rather than a domain name. It specifically looks for command-line arguments that indicate a download operation (e.g., '-O', '--remote-name', '--output') and the presence of an IP address in the URL. The rule also filters for common executable and script file extensions, suggesting the download of malicious payloads. This activity is often associated with adversaries attempting to retrieve tools or malware onto a compromised system, bypassing typical domain-based reputation checks.
Page 590 of 680