SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,502 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects PowerShell scripts that create TCP listeners and accept client connections, which is indicative of tunneling activity. The rule specifically looks for the use of '[System.Net.HttpWebRequest]', 'System.Net.Sockets.TcpListener', and 'AcceptTcpClient' within the script block text.
This rule detects PowerShell script execution where the 'WindowStyle Hidden' option is used. Adversaries often use this technique to conceal malicious activity from users by preventing the PowerShell window from being visible. The rule specifically looks for the combination of 'powershell', 'WindowStyle', and 'Hidden' within the script block text. A filter is applied to exclude legitimate Amazon WorkSpaces configuration scripts that use this option.
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file. This activity is often associated with reconnaissance phases where attackers enumerate Active Directory users for further targeting.
This rule detects PowerShell script blocks that create an XML document object, load content into it, and then attempt to execute commands using common PowerShell execution cmdlets like 'IEX', 'Invoke-Expression', or 'Invoke-Command'. This combination is often used by adversaries to load and execute malicious code, potentially from an external source or obfuscated within an XML structure.
Detects suspicious access to the Local Security Authority Subsystem Service (LSASS) process memory. This rule specifically looks for access to 'lsass.exe' originating from 'svchost.exe' with a specific suspicious access right ('0x14c0') and a call trace indicating 'seclogon.dll'. This combination suggests an attempt to dump LSASS memory, potentially to steal credentials.
Detects a possible process memory dump of LSASS using processes with whitelisted filenames (like TrolleyExpress.exe, ProcessDump.exe, dump64.exe) to evade detection by security products like Microsoft Defender. The rule specifically looks for access to lsass.exe with granted access rights commonly associated with memory dumping.
Detects suspicious access to the "svchost" process with a high level of granted access (0x1F3FFF) and an unknown call trace. This behavior is often associated with techniques like those used by Invoke-Phantom to terminate critical system processes, such as the Windows event logging service, to evade detection. The rule filters out legitimate MSBuild activity that might exhibit similar call trace characteristics.
Detects the execution of the Add-In deployment cache updating utility (AddInUtil.exe) when it is used with suspicious AddInRoot or PipelineRoot paths. Adversaries may leverage this legitimate utility to load their malicious add-ins by pointing to uncommon or user-controlled directories like temporary folders, desktop, downloads, or public user directories. This technique can be used for defense evasion by proxying execution through a trusted binary.
This rule detects attempts to tamper with Windows audit policies using an older version of the `auditpol` binary, specifically from the NT resource kit. Adversaries may use this method to disable or remove certain audit policies, or restore a custom policy, thereby impairing detection capabilities by limiting the logging of security-relevant events.
This rule detects the execution of the Microsoft bash launcher (bash.exe) without any command-line flags. This behavior can be indicative of an adversary attempting to bypass security defenses by executing Linux or Windows-based binaries indirectly through bash, potentially leveraging it as a living-off-the-land binary (LOLBAS). The rule specifically looks for bash.exe being run without common flags like '-' or an empty command line, suggesting an attempt to execute a script or command without directly specifying it as an argument.
Page 558 of 680