SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,501 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects obfuscated PowerShell scripts that utilize 'clip.exe' to interact with the clipboard, potentially for defense evasion or data manipulation. The rule specifically looks for the pattern 'echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?)' within PowerShell script block text, indicating an attempt to pipe output to clip.exe and then interact with the clipboard or invoke further commands.
Detects highly obfuscated PowerShell commands using a specific pattern associated with 'VAR++ LAUNCHER' obfuscation techniques, often employed by tools like Invoke-Obfuscation. The rule looks for a regex pattern that includes '&&set', repeated curly brace digits (e.g., '{1}{2}'), '-f', and 'cmd /c', indicating an attempt to construct and execute a command in an obfuscated manner.
Detects obfuscated PowerShell code being executed via standard input (stdin) within script block logs. This often indicates an attempt to evade detection by hiding malicious commands.
This rule detects the use of PowerShell to instantiate the MsXml2.XmlHttp COM object. Adversaries may abuse PowerShell commands and scripts for execution, and the MsXml2.XmlHttp COM object can be used for network communication, such as downloading additional payloads or exfiltrating data. This technique is often used by malware or attackers to perform actions like C2 communication or data transfer.
Detects attempts to write data into NTFS Alternate Data Streams (ADS) using PowerShell cmdlets like `Set-Content` or `Add-Content` in conjunction with the `-Stream` parameter. This technique can be used by adversaries to hide malicious data or executables on a system.
This rule detects the use of 'PromptForCredential' within PowerShell script block logs. This function is used to display a dialog box that prompts the user for credentials, which can be abused by adversaries to harvest user credentials. Detection relies on PowerShell Script Block Logging being enabled.
Detects the use of the PSAttack PowerShell hack tool by looking for the specific string 'PS ATTACK!!!' within PowerShell script block logs. This tool is often used for post-exploitation activities.
This rule detects PowerShell commands that attempt to discover sensitive files by looking for common file extensions associated with credentials or password managers (e.g., .pass, .kdbx, .kdb). It specifically targets commands like 'ls', 'get-childitem', or 'gci' combined with the '-recurse' parameter, indicating a recursive search for these sensitive file types.
Detects PowerShell script blocks that manipulate security descriptors using specific WMI classes and properties (win32_Trustee, win32_Ace, .AccessMask, .AceType, .SetSecurityDescriptor) in conjunction with specific LSA registry paths (Lsa\JD, Lsa\Skew1, Lsa\Data, Lsa\GBG). This combination is indicative of potential persistence mechanisms, as seen in projects like DAMP, which aim to backdoor systems by modifying security settings to maintain access or elevate privileges.
This rule detects the execution of a PowerShell command containing 'Get-Process lsass' within a script block. This command is commonly used by attackers to identify the LSASS process ID before attempting to dump its memory for credential harvesting. The detection relies on PowerShell Script Block Logging being enabled.
Page 557 of 680