SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,506 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for distinct string manipulation and variable concatenation techniques used by the framework within the ServiceFileName field of Windows Security Event ID 4697.
This rule detects the creation of a new Windows service (EventID 4697) where the service's file name contains specific PowerShell commands indicative of Invoke-Obfuscation's COMPRESS OBFUSCATION technique. Specifically, it looks for the presence of 'new-object', 'text.encoding]::ascii', 'readtoend', and either 'system.io.compression.deflatestream' or 'system.io.streamreader'. This combination suggests an attempt to decompress and execute obfuscated PowerShell code.
Detects obfuscated PowerShell execution initiated via rundll32.exe, specifically looking for the combination of 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell' within the ServiceFileName field of Windows Security Event ID 4697 (Service Creation). This technique is often used for defense evasion and to execute malicious PowerShell scripts.
Detects obfuscated PowerShell execution initiated via rundll32.exe. This rule specifically looks for Windows Security Event ID 4697 (A service was installed in the system) where the ServiceFileName contains specific keywords indicative of rundll32.exe being used to execute obfuscated commands, potentially involving PowerShell.
This rule detects when an authenticated user, who is not authorized for remote logon, attempts to connect to a computer via Remote Desktop. This event can indicate an attacker attempting to discover and access available Windows servers on the network.
Detects the registration of the VSSAudit security event source, which typically occurs during volume shadow copy operations. This can be indicative of credential dumping attempts, specifically targeting the Security Account Manager (SAM) database.
Detects workstation session lock events that occur automatically after a standard period of inactivity. This event indicates that a user's session has been locked, typically due to inactivity or a manual lock action. While often a security measure, monitoring these events can help identify unusual patterns of workstation locking, which might precede or follow other suspicious activities, or indicate policy compliance issues.
This rule detects when the Sysmon service crashes, indicated by an 'Application Popup' event with EventID 26 and a caption explicitly mentioning 'sysmon.exe - Application Error' or 'sysmon64.exe - Application Error'. This could signify an attempt to impair or disable Sysmon, which is a critical defense mechanism for endpoint monitoring.
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name (SAM or SECURITY) located in the temporary directory have been reset. This behavior can occur when an application attempts to access a hive that has not been recognized for a period (default 7 days). Registry hive dumping utilities such as QuarksPwDump have been observed to exhibit this behavior, which is often associated with credential dumping.
This rule detects the creation of a new Windows service (EventID 7045 from 'Service Control Manager') where the 'ImagePath' contains patterns indicative of obfuscated PowerShell execution via standard input (stdin). Specifically, it looks for the presence of 'set' and '&&' along with keywords like 'environment', 'invoke', or 'input' within the service's executable path, suggesting an attempt to execute obfuscated commands.
Page 513 of 680