SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,605 copies16 likes160,564 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects PowerShell scripts leveraging the "Invoke-WebRequest" or "Invoke-RestMethod" cmdlets to send data using either the "PUT" or "POST" HTTP method. This behavior can indicate an attempt to exfiltrate data from the system.
Detects PowerShell execution using Invoke-WebRequest (or its aliases like curl, wget, Invoke-RestMethod, irm, iwr) to connect to an IP address directly. This behavior can be indicative of malware downloading additional stages or establishing command and control, especially when avoiding DNS resolution.
Detects the use of `reg.exe` or PowerShell to delete the Windows Defender context menu handler registry keys. This action removes the "Scan with Microsoft Defender" option from the right-click menu for files, directories, and drives. Attackers may use this technique to hinder manual, on-demand scans and reduce the visibility of the security product.
Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.
Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'. This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level, allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.
This rule detects PowerShell scripts that utilize web request cmdlets (Invoke-WebRequest, Invoke-RestMethod, irm, iwr) along with the '-UserAgent' parameter. Adversaries often modify user agents to mimic legitimate traffic or specific applications, blending in with normal network activity to evade detection while communicating with command and control servers or exfiltrating data.
Detects suspicious execution of PowerShell's Invoke-WebRequest cmdlet (or its aliases like curl, iwr, wget) when the output is directed to a suspicious location. Adversaries often use this technique to download malicious tools or files into user-controlled directories like AppData, Desktop, Temp, or Public folders, or directly into the Windows directory, which are not typical locations for legitimate Invoke-WebRequest output.
Detects the use of encoded or obfuscated IP addresses (hex, octal, etc.) within a URL in conjunction with common download commands. This technique is often used by adversaries to evade simple network-based detections or to obscure their infrastructure.
Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity default action to 'Allow' (value '6') or 'NoAction' (value '9'). This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level. An attacker might use this technique via the command line to bypass defenses before executing payloads.
Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets. This activity is often associated with adversaries transferring malicious tools or components into a compromised environment.
Page 295 of 680