SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,508 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects obfuscated use of stdin to execute PowerShell commands, specifically looking for the creation of a service with a command line containing 'cmd', 'powershell', input redirection ('${input}'), 'noexit', and command execution flags (' /c ', ' /r '). This pattern is indicative of techniques used by tools like Invoke-Obfuscation to hide malicious PowerShell execution.
Detects obfuscated use of environment variables to execute PowerShell commands. This technique is often used by adversaries to evade detection by security products. The rule specifically looks for the creation of a service with a command-line containing 'cmd', 'set', '-f', and either '/c' or '/r', which are indicative of a PowerShell command being constructed and executed via environment variables.
Detects the use of Invoke-Obfuscation's VAR++ LAUNCHER technique, which obfuscates PowerShell commands using variable manipulation and string formatting. This technique is identified by specific patterns in the ServiceFileName field of Windows Security Event ID 4697, indicating a service creation with obfuscated command-line arguments.
Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.
Detects when a password-protected ZIP archive is opened on a Windows system, specifically looking for archives with suspicious filenames commonly used in phishing or social engineering attacks (e.g., 'invoice', 'order', 'payment'). This rule leverages Windows Security Event ID 5379, which indicates a sensitive privilege use, and filters for events related to the Microsoft_Windows_Shell_ZipFolder:filename provider, combined with a list of suspicious keywords in the TargetName field.
This rule detects suspicious activity related to the Windows User Profile Service, specifically looking for EventID 1511 (Windows cannot find the local profile and is logging you on with a temporary profile) from the 'Microsoft-Windows-User Profiles Service' provider. This event, especially when combined with EventID 1515 (user profile loaded successfully) and the creation of a '\Users\TEMP' directory, can indicate an attempt to exploit vulnerabilities like CVE-2021-34484 or CVE-2022-21919 for privilege escalation. The rule focuses on the initial indication of a temporary profile being loaded.
Detects obfuscated use of standard input (STDIN) to execute PowerShell commands, often associated with techniques like Invoke-Obfuscation. The rule looks for the creation of a service (EventID 7045) where the ImagePath contains 'cmd' and 'powershell', along with command-line arguments indicating execution ('/c' or '/r') and either 'noexit' or the '$input' variable, which are common patterns for executing PowerShell from STDIN.
Detects the creation of a new Windows service where the ImagePath contains highly obfuscated PowerShell commands. Specifically, it looks for 'cmd' executing a 'set' command to define an environment variable, followed by PowerShell execution with the '-f' format operator, which is characteristic of Invoke-Obfuscation's VAR+ launcher technique. This method uses environment variables and string manipulation to hide malicious PowerShell code.
Detects obfuscated PowerShell commands used in service creation events, specifically looking for patterns indicative of Invoke-Obfuscation's VAR++ LAUNCHER technique. The rule identifies service creations where the ImagePath contains specific keywords like '&&set', 'cmd', '/c', '-f', and format specifiers like '{0}', '{1}', etc., which are characteristic of highly obfuscated PowerShell commands often used for defense evasion.
Detects the creation of a new service where the ImagePath contains 'mshta' and 'vbscript:createobject', indicating potential obfuscated PowerShell execution via MSHTA. This technique is often used for defense evasion and execution.
Page 503 of 680