SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on remote machines. The rule specifically looks for PDQDeployRunner spawning suspicious child processes, executing commands with suspicious arguments, or executing from suspicious paths, which could indicate abuse for malicious purposes.
Detects PowerShell execution that includes base64 encoded WMI class names such as "Win32_ShadowCopy", "Win32_ScheduledJob", "Win32_Process", "Win32_UserAccount", or "Win32_LoggedOnUser" in the command line. This technique is often used by adversaries to obfuscate their actions and evade detection.
Detects the use of the PowerShell `New-MailboxExportRequest` cmdlet to export a mailbox to a remote or local share. This activity has been observed in ProxyShell exploitation scenarios, where attackers exfiltrate mailbox data. The rule specifically looks for the cmdlet name, the `-Mailbox` parameter, and the `-FilePath` parameter followed by a UNC path (indicating a share).
Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking. This technique leverages a signed binary to proxy execution of malicious code, specifically by exploiting module load-order hijacking to execute PowerShell commands.
Detects PowerShell script execution from an Alternate Data Stream (ADS). This rule identifies instances where 'powershell.exe' or 'pwsh.exe' is launched, and its command line arguments include 'Get-Content' and '-Stream'. This combination indicates that PowerShell is being used to read and potentially execute content hidden within an Alternate Data Stream, a common technique for defense evasion.
Detects the use of the built-in Windows utility 'query.exe' to extract information about active user sessions or running processes. This activity can be indicative of an attacker performing reconnaissance or staging data for exfiltration.
Detects the usage of 'reg.exe' to dump sensitive registry hives, specifically targeting the SAM, SYSTEM, and SECURITY hives. This activity is indicative of credential dumping attempts.
Detects the usage of 'reg.exe' to query reconnaissance information from the Windows registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software, specifically looking for common persistence mechanisms and service configurations.
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe". This technique leverages a legitimate Windows binary to proxy the execution of malicious commands, often for defense evasion.
Detects modifications or additions to the 'TypedPaths' registry key via the command line, which can indicate an attempt to establish persistence. The 'TypedPaths' key stores recently typed paths in Windows Explorer, and adversaries might manipulate it to execute malicious code when a user accesses certain paths.
Page 533 of 680