SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,512 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the creation of specific files that indicate interactive PowerShell usage within the SYSTEM user context. The rule looks for the creation of 'ConsoleHost_history.txt' or 'StartupProfileData-Interactive' files in the 'C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\' or 'C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\' directories respectively. The presence of these files in the SYSTEM profile suggests that PowerShell was used interactively by the SYSTEM account, which is highly unusual and could indicate privilege escalation or malicious activity.
This rule detects PowerShell script blocks that attempt to register an XLL (Excel Add-in) file using COM objects. Adversaries may abuse Microsoft Office add-ins, specifically XLL files, to establish persistence on a compromised system. The detection looks for the combination of 'new-object', '-ComObject', '.application', and '.RegisterXLL' within a PowerShell script block, indicating an attempt to programmatically register an XLL add-in.
This rule detects the use of the PowerShell cmdlet 'Mount-DiskImage' with the '-ImagePath' parameter. Adversaries may use this technique to mount disk image files (like ISO or VHD) containing malicious payloads. This method can bypass Mark-of-the-Web (MOTW) controls, as files extracted or accessed from a mounted image may not inherit the MOTW, allowing them to execute without typical security warnings or protections.
Detects modifications to Windows Defender configuration settings using PowerShell to add exclusions. This activity is often performed by adversaries to disable or bypass security controls, allowing their malicious activities to go undetected.
Detects suspicious child processes spawned by "BgInfo.exe" or "BgInfo64.exe". This behavior can indicate an attempt to abuse BgInfo, a legitimate Microsoft utility, for proxy execution of other binaries or scripts, often to bypass application whitelisting or other security controls. The rule specifically looks for common command-line interpreters (cmd.exe, powershell.exe, cscript.exe, wscript.exe), other executables (calc.exe, notepad.exe, mshta.exe), or executables launched from suspicious user-writable directories (AppData, Users\Public, Temp, PerfLogs).
Finger.EXE Execution
Sigma
Detects the execution of the "finger.exe" utility, which is an old Windows utility used to display information about users on a remote computer running the finger service. Due to its age and the rarity of the finger service being active, any execution of this utility is considered suspicious and warrants investigation.
This rule detects the use of Gpg4win (gpg.exe or gpg2.exe) to encrypt or decrypt files. The detection specifically triggers when the command line includes the '-passphrase' argument and the file being operated on is located in suspicious directories such as 'PerfLogs', 'Temp', 'Users\Public', 'Windows\Temp', 'AppData\Local\Temp', or 'AppData\Roaming'. This behavior can indicate an adversary encrypting collected data before exfiltration or using these common staging areas for malicious operations.
This rule detects the execution of `ruby.exe` with command-line arguments indicative of Evil-WinRM usage. Specifically, it looks for the presence of `-i`, `-u`, and `-p` flags, which are commonly used by Evil-WinRM for specifying the target IP address, username, and password for Windows Remote Management (WinRM) access. This activity suggests an adversary is attempting to establish remote control over a system using a known penetration testing tool.
Detects attempts to downgrade PowerShell to version 2.0 by checking for specific command-line arguments. This technique is often used by adversaries to bypass security features like Script Block Logging and AMSI, which are present in newer versions of PowerShell.
Detects the usage of the ".Net.Sockets.TCPClient" class within PowerShell, which is commonly abused to establish remote connections and reverse shells. This technique is notably used by tools like Nishang's "Invoke-PowerShellTcpOneLine" and other malicious scripts to create outbound network connections for command and control or data exfiltration.
Page 458 of 680