SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the execution of PowerShell cmdlets related to 'TroubleshootingPack' with specific arguments, which could indicate an attempt to leverage vulnerabilities like CVE-2022-30190 (Follina) or similar techniques used by the 'msdt' LOLBIN (Living Off the Land Binaries). The detection specifically looks for the combination of 'Invoke-TroubleshootingPack', the path 'C:\Windows\Diagnostics\System\PCW', '-AnswerFile', and '-Unattended' within the PowerShell script block text. This pattern is indicative of an attempt to execute diagnostic packages in an unattended manner, often exploited for arbitrary code execution.
Detects PowerShell scripts that use the System.Net.WebClient class to download files or strings from the internet. This is a common technique used by adversaries to retrieve malicious payloads or additional tools.
This rule detects PowerShell script block text that contains commands indicative of searching for credentials in files. Specifically, it looks for the combination of 'ls' (list directory contents), '-R' (recursive search), 'select-string' (finds text in strings and files), and '-Pattern' (specifies the text pattern to find). This combination suggests an adversary is recursively searching files for specific patterns, likely credentials.
Detects PowerShell code that uses `GetTypeFromCLSID` in conjunction with `.ShellExecute(` to execute COM objects. This technique can be used for persistence or privilege escalation by adversaries.
This rule detects PowerShell scripts attempting to open a handle to a drive volume using the `IO.FileStream` object and the `\\.\` DOS device path specifier. This technique is often used for direct access to the volume, bypassing standard file system controls.
This rule detects suspicious PowerShell script blocks that contain specific .NET classes often used in LDAP-based credential access attempts. The presence of 'System.DirectoryServices.Protocols.LdapDirectoryIdentifier', 'System.Net.NetworkCredential', and 'System.DirectoryServices.Protocols.LdapConnection' within a PowerShell script block suggests an attempt to interact with an LDAP directory, potentially for password guessing or brute-force attacks against accounts.
This rule detects PowerShell commands that perform reconnaissance activities (getting services, child items, or processes) and redirect their output to a file in the temporary directory. This behavior is indicative of an adversary collecting internal system information for potential exfiltration or further analysis.
This rule detects the use of 'X509Enrollment' objects within PowerShell scripts. Adversaries may use X509Enrollment to install root certificates, which can be leveraged to bypass security warnings when connecting to adversary-controlled web servers or to sign malicious code, thereby subverting trust controls and enabling defense evasion.
Detects attempts to dump LSASS process memory using WerFault.exe. This technique is often used by tools like Mimikatz, NanoDump, Invoke-Mimikatz, Procdump, or Taskmgr to extract credentials from the Local Security Authority Subsystem Service (LSASS) process. The rule specifically looks for WerFault.exe accessing lsass.exe with a GrantedAccess of '0x1FFFFF', which indicates full access.
This rule detects a User Account Control (UAC) bypass technique that leverages a WoW64 logger DLL hijack, specifically referencing UACMe method 30. It identifies process access events where the source image is located in 'C:\Windows\SysWOW64\', requests full access ('0x1fffff'), and exhibits an unknown call trace pattern starting with 'UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|'. This combination of indicators suggests an attempt to elevate privileges by injecting a malicious DLL into a trusted process.
Page 538 of 680