SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects PowerShell scripts that add a Name Resolution Policy Table (NRPT) rule. An NRPT rule can be used to bypass the default DNS server and force DNS queries for specific namespaces to a different, specified DNS server. This technique can be used by adversaries to redirect traffic, potentially for command and control, data exfiltration, or to evade network filtering.
This rule detects the execution of the PowerShell cmdlet 'Invoke-Command' with the '-ComputerName' parameter. This combination indicates an attempt to execute commands on a remote host using Windows Remote Management (WinRM). Adversaries commonly use this technique for lateral movement within a network after gaining valid credentials.
Detects obfuscated PowerShell execution leveraging `clip.exe` to retrieve commands from the clipboard. This technique is often used for defense evasion to hide malicious scripts.
This rule detects the creation of a new PowerShell remote session using the 'New-PSSession' cmdlet, specifically when targeting a remote computer via the '-ComputerName' parameter. This activity can be indicative of an adversary establishing remote access or moving laterally within a network.
Detects PowerShell module creation where the module contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This is indicative of potential abuse of the "RemoteFXvGPUDisablement.exe" binary, which is known to be vulnerable to module load-order hijacking. This technique can be used for defense evasion and proxy execution.
This rule detects the execution of the PowerShell cmdlet 'Get-GPO'. This cmdlet is used to retrieve information about Group Policy Objects (GPOs) in a domain. Adversaries may use this for discovery purposes to understand the domain's policy configurations, which can aid in identifying potential privilege escalation paths or misconfigurations.
Detects PowerShell scripts that utilize the "Compress-Archive" cmdlet to compress folders and files, storing the output in common temporary directories often used by adversaries for data staging prior to exfiltration. This behavior is indicative of an adversary preparing collected data for exfiltration by archiving it to minimize size and make it portable.
Detects the execution of the `AgentExecutor.exe` binary when it is used to execute PowerShell scripts. This binary can be abused as a Living Off The Land Binary (LOLBIN) to run PowerShell scripts with the ExecutionPolicy set to "Bypass" or to execute any binary named "powershell.exe" located in a path provided as the 6th positional argument. The rule specifically looks for `AgentExecutor.exe` being executed with command-line arguments indicating PowerShell script execution, such as `-powershell` or `-remediationScript`. It filters out legitimate usage where the parent process is `Microsoft.Management.Services.IntuneWindowsAgent.exe`.
Detects the usage of `attrib.exe` with the `+s` option to set scripts or executables located in suspicious directories as system files. This technique is used to hide files from users and prevent them from being easily deleted. The rule specifically targets common suspicious locations and file extensions to reduce false positives.
Detects uncommon child processes spawned by 'BgInfo.exe' or 'BgInfo64.exe'. This behavior can indicate an adversary abusing BgInfo, a legitimate Microsoft utility, to proxy execution of malicious code, potentially via external VBScript, as part of defense evasion or execution tactics.
Page 530 of 680