SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,499 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the execution of the Perl interpreter using the `-e` or `-E` flags. These flags allow for inline execution of Perl code directly from the command line, which can be leveraged by adversaries to launch reverse shells, execute arbitrary commands, or run malicious scripts without needing to write a Perl file to disk. This technique is often used in post-exploitation scenarios for stealthy command execution.
Detects the execution of the PHP interpreter using the "-r" flag, which allows for inline execution of PHP code. This method can be leveraged by adversaries to execute arbitrary PHP code, potentially for launching reverse shells or other malicious activities.
Detects potential DLL sideloading using the Microsoft Office Winword process. This rule specifically looks for the execution of 'WINWORD.exe' with the command-line arguments '/l' and a '.dll' file, which is a known method for arbitrary DLL loading.
Detects the use of PowerShell's 'Import-Module' cmdlet to load the 'Microsoft.ActiveDirectory.Management.dll'. This DLL is part of the Active Directory module and is frequently used by attackers for Active Directory enumeration, especially in environments where RSAT (Remote Server Administration Tools) might not be installed or administrative privileges are not initially present.
Detects attempts to capture audio using PowerShell cmdlets, specifically looking for commands related to the 'WindowsAudioDevice-Powershell-Cmdlet' module or similar audio device manipulation cmdlets. This activity could indicate an adversary attempting to record sensitive conversations or gather information from the compromised system's environment.
This rule detects the execution of PowerShell commands that utilize base64 encoded 'IEX' (Invoke-Expression) cmdlets. Adversaries often encode malicious PowerShell scripts in base64 to evade detection and obfuscate their intentions. The rule specifically looks for patterns indicative of base64 encoded 'IEX' calls, including variations with 'New-Object' and different casing, as well as UTF-16 LE encoded versions of common 'IEX' patterns.
Detects the creation of a new Windows service using PowerShell cmdlets, specifically looking for 'New-Service' and '-BinaryPathName' in the command line. This activity can be indicative of persistence mechanisms or privilege escalation attempts by adversaries.
Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet to enumerate local group memberships, specifically looking for common administrative or privileged groups. This activity is often performed by attackers during the discovery phase to identify potential privilege escalation paths or valuable targets.
Detects the installation of a Microsoft Exchange Transport Agent by monitoring for the 'Install-TransportAgent' command-line argument. This activity can be used by adversaries to establish persistence on Exchange servers.
Detects non-interactive PowerShell activity by identifying PowerShell processes (powershell.exe or pwsh.exe) that are not spawned by typical user-facing graphical interface processes such as explorer.exe. This rule aims to identify PowerShell execution that is not directly initiated by a user through interactive means, potentially indicating automated or malicious activity. It includes filters for known legitimate parent processes like those associated with Windows updates, VS Code, and Windows Terminal to reduce false positives.
Page 564 of 680