SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the execution of a PowerShell command that specifically enumerates browser bookmarks. It looks for the use of 'Get-ChildItem' with parameters '-Recurse', '-Path', '-Filter Bookmarks', '-ErrorAction SilentlyContinue', and '-Force'. This activity is indicative of an adversary attempting to discover information about the compromised host by collecting browser bookmark data, which can reveal personal information or details about internal network resources.
This rule detects the use of the 'Get-AdGroup' PowerShell cmdlet with the '-Filter' parameter to enumerate groups within Active Directory. This activity is often performed by attackers during the discovery phase to identify privileged groups and users.
This rule detects the execution of the Invoke-DNSExfiltrator PowerShell cmdlet, which is used for exfiltrating data over a DNS request covert channel. The detection specifically looks for the presence of the cmdlet name along with common parameters such as '-i', '-d', '-p', '-doh', and '-t', indicating an attempt to use the DNSExfiltrator tool.
Detects PowerShell script block logging (Event ID 4104) entries that indicate the use of Invoke-Obfuscation's COMPRESS obfuscation technique. This technique typically involves using 'new-object' with 'text.encoding::ascii' and 'system.io.compression.deflatestream' or 'system.io.streamreader' followed by 'readtoend' to decompress and execute obfuscated code.
This rule detects the execution of PowerShell commandlets and functions associated with the Nishang exploitation framework. Nishang is a collection of PowerShell scripts and functions that enable penetration testers to use PowerShell for offensive security tasks. The rule specifically looks for a comprehensive list of known Nishang commandlet names and arguments within PowerShell script block logs. Detection of these strings indicates potential malicious activity, including credential dumping, persistence mechanisms, exfiltration, and remote code execution.
Detects the use of 'PSAsyncShell', an asynchronous TCP reverse shell written in PowerShell. The rule specifically looks for the string 'PSAsyncShell' within PowerShell script block logs, indicating the execution or presence of this specific tool.
This rule detects the execution of PowerShell scripts containing specific Base64 encoded shellcode signatures. The rule looks for the presence of 'OiCAAAAYInlM' or 'OiJAAAAYInlM' within the ScriptBlockText, which are known indicators of shellcode.
This rule detects the execution of specific PowerShell commandlets associated with the ShellIntel exploitation framework. These commandlets, such as 'Invoke-SMBAutoBrute', 'Invoke-GPOLinks', and 'Invoke-Potato', are commonly used for reconnaissance, privilege escalation, and lateral movement within a Windows environment. Detection relies on PowerShell Script Block Logging to capture the script text containing these commandlet names.
Detects the use of PowerShell commands or .NET methods to identify the current logged-in user on a Windows system. This activity is often performed by adversaries during the discovery phase to understand the environment.
This rule detects the use of the PowerShell cmdlet 'Unblock-File' with the '-Path' parameter. This cmdlet is used to remove the Zone.Identifier alternate data stream from a file, which marks it as downloaded from the internet. Adversaries may use this to bypass security warnings and execution restrictions associated with files downloaded from untrusted sources, often as part of a defense evasion strategy.
Page 547 of 680