SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,505 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of the PowerShell `New-MailboxExportRequest` cmdlet to export a mailbox to a remote or local share, which has been observed in ProxyShell exploitation scenarios. This activity indicates an attempt to exfiltrate mailbox data.
Detects the execution of PowerShell scripts containing patterns commonly associated with Mimikatz, a tool used for dumping credentials. The rule looks for specific strings related to Mimikatz functionalities like 'DumpCreds', 'DumpCerts', 'sekurlsa::logonpasswords', and 'crypto::certificates' in conjunction with 'CERT_SYSTEM_STORE_LOCAL_MACHINE'.
This rule detects PowerShell script blocks that contain keywords associated with collecting local email data, specifically targeting Microsoft Outlook. It looks for script names like 'Get-Inbox.ps1' or the use of Outlook COM objects ('Microsoft.Office.Interop.Outlook', 'Microsoft.Office.Interop.Outlook.olDefaultFolders', '-comobject outlook.application'). This activity is indicative of an adversary attempting to gather sensitive information from a user's local email client.
This rule detects the use of `Start-Process` with the `-PassThru` and `-FilePath` parameters in PowerShell script blocks. The `-PassThru` parameter allows `Start-Process` to return a process object, which can be used to interact with the started process in the background, potentially for stealthy execution or to bypass interactive prompts. The `-FilePath` parameter specifies the executable to run. This combination can be indicative of an adversary attempting to execute a process in a less conspicuous manner.
This rule detects attempts to change the desktop wallpaper using PowerShell. It specifically looks for PowerShell script block text that either modifies the 'WallPaper' property within the 'HKEY_CURRENT_USER\Control Panel\Desktop\' registry key or calls the 'SystemParametersInfo' function with specific parameters (20, 0, *, 3), which is a Windows API call used to set the desktop wallpaper. This activity is indicative of an adversary attempting to deface a system.
Detects attempts to modify a PowerShell user profile using the `Add-Content` cmdlet to inject suspicious commands. This technique can be used for persistence, as the injected commands will execute every time a PowerShell session starts for that user.
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass. This technique is often used to extract credentials.
This rule detects potential malicious and unauthorized usage of 'bcdedit.exe' by monitoring process creation events. Specifically, it looks for 'bcdedit.exe' being executed with command-line arguments related to deleting boot entries or values, importing boot data, or enabling safe boot with network capabilities. Such commands can be indicative of ransomware attempting to tamper with the Master Boot Record (MBR) or other boot configurations to prevent system startup or establish persistence, or other forms of bootkit activity.
Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in, which is a common method for privilege escalation and persistence.
This rule detects the usage of path traversal techniques within the command line of 'conhost.exe'. This behavior can indicate an attempt to confuse or hijack command arguments, potentially leading to indirect command execution. Specifically, it looks for '/../../' in the command line when 'conhost' is present in the parent command line.
Page 524 of 680