SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,506 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects when a Common Language Runtime (CLR) DLL, specifically 'clr.dll', is loaded by any of the specified Microsoft Office applications (Excel, Publisher, Outlook, OneNote, PowerPoint, Word). This activity can be indicative of malicious code execution, as adversaries might leverage CLR to execute .NET assemblies within the context of a legitimate Office process, potentially bypassing security controls or achieving persistence.
Detects when a DLL from the Global Assembly Cache (GAC) is loaded by a Microsoft Office application. This behavior can be indicative of malicious activity, such as DLL hijacking or persistence mechanisms, where an attacker might try to load their own malicious DLLs disguised as legitimate GAC assemblies through Office applications.
This rule detects when Microsoft Excel loads an Add-In (.xll) file from an uncommon or potentially suspicious location. Adversaries often use XLL files for initial access or execution by embedding malicious code within them, and loading them from non-standard directories like Desktop, Downloads, Temp, or Public user folders can indicate malicious activity. The rule specifically looks for excel.exe loading an .xll file from a predefined list of suspicious directories.
Detects when a Microsoft Office application (Excel, Publisher, Outlook, OneNote, PowerPoint, Word) loads a PowerShell core DLL. This behavior is highly suspicious as Office applications typically do not need to load PowerShell DLLs, and it can indicate an attempt to execute PowerShell code within the context of a trusted Office application, potentially for defense evasion or malicious scripting.
Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicate a remote PowerShell connection, often associated with Windows Remote Management (WinRM). The rule filters out connections from common network service accounts and localhost to reduce false positives.
This rule detects the use of 'powercat' or 'powercat.ps1' within PowerShell classic logs. Powercat is a PowerShell-based network utility similar to Netcat, often used by adversaries for network communication, including reverse shells, bind shells, and file transfers, potentially bypassing traditional network controls. This activity is indicative of command and control communication or lateral movement using non-application layer protocols.
Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.
This rule detects the use of the 'Get-Clipboard' command within PowerShell logs. This command allows an adversary to retrieve the current content of the system clipboard, which could contain sensitive information copied by a user.
This rule identifies attempts to clear the PowerShell console history. Adversaries often clear command history to remove traces of their activities on a compromised system, making forensic analysis more difficult. The rule specifically looks for the 'Clear-History' cmdlet or the deletion of the 'ConsoleHost_history.txt' file, which stores PowerShell command history.
Detects PowerShell scripts attempting to modify Access Control Lists (ACLs) on files or directories within the Windows system folders. This activity is suspicious as it can be used by adversaries to gain persistence, elevate privileges, or evade defenses by modifying critical system file permissions.
Page 516 of 680