SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,531 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects audio capture via PowerShell Cmdlet.
Detects base64 encoded strings used in hidden malicious PowerShell command lines
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
Detects attempts of decoding encoded Gzip archives via PowerShell.
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Detects email exfiltration via powershell cmdlets
Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.
Detects powershell scripts that import modules from suspicious directories
Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.
Page 657 of 680