SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,525 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string
Detects Commandlet names and arguments from the Nishang exploitation framework
PowerShell SAM Copy
Sigma
Detects suspicious PowerShell scripts accessing SAM hives
Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains
Commandline to launch powershell with a base64 payload
Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.
In some cases, windows that would typically be displayed when an application carries out an operation can be hidden
In some cases, windows that would typically be displayed when an application carries out an operation can be hidden
Adversaries may abuse PowerShell commands and scripts for execution.
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system
Page 675 of 680