SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,505 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of named pipes with specific patterns known to be used by Cobalt Strike's malleable C2 profiles. This rule identifies common pipe names and patterns associated with Cobalt Strike's inter-process communication, including generic profiles and those related to catalog change listeners.
Detects the WMI Event Consumer service process (scrcons.exe) creating a named pipe. This activity can be indicative of WMI persistence mechanisms being used by adversaries, often in conjunction with named pipes for inter-process communication or command and control.
This rule detects the initiation of a remote PowerShell session by looking for specific strings in PowerShell Classic logs. Specifically, it identifies events where 'HostName=ServerRemoteHost' and 'wsmprovhost.exe' are present in the log data, indicating that a remote host is interacting via Windows Remote Management (WinRM) to execute PowerShell commands.
Detects the usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dll" DLL. This DLL is often used by attackers to perform Active Directory enumeration, especially in environments where RSAT (Remote Server Administration Tools) are not installed or administrative privileges are not available.
Detects PowerShell commands or scripts that attempt to disable the command history by removing the 'psreadline' module. This action is often performed by adversaries to evade detection and hinder forensic analysis by preventing their commands from being logged.
Detects the usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" with the '-Online' parameter to enable specific Windows optional features. This cmdlet is similar to DISM.exe and can be used to enumerate, install, uninstall, configure, and update features and packages in Windows images. The rule specifically looks for the enabling of potentially suspicious features like Telnet Server, Internet Explorer, TFTP Client, SMB1 Protocol, Client-ProjFS, and Microsoft-Windows-Subsystem-Linux.
Detects the usage of the PowerShell `Set-Mailbox` cmdlet to configure an SMTP forwarding rule for a mailbox. This can be indicative of an adversary setting up automatic email forwarding to an external address for data exfiltration or continued access to communications.
Detects PowerShell script blocks attempting to exfiltrate data using ICMP by creating a System.Net.NetworkInformation.Ping object and sending data. This method allows adversaries to bypass traditional network controls by tunneling data over ICMP.
This rule detects PowerShell scripts that attempt to import modules from suspicious directories such as the user's temporary folder ($Env:Temp), application data folder ($Env:Appdata), or the C:\Users\Public\ directory. Adversaries often use these locations to drop and execute malicious PowerShell modules to evade detection or achieve persistence.
Detects the use of obfuscated PowerShell commands that leverage STDIN for execution, often associated with tools like Invoke-Obfuscation. The rule specifically looks for patterns where 'cmd' is used to launch PowerShell with input redirection or the 'noexit' parameter, combined with a reference to 'input' or 'noexit' within the script block text.
Page 523 of 680