SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,496 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects suspicious PowerShell scripts attempting to copy the Security Account Manager (SAM) database. It specifically looks for PowerShell command lines that include both a reference to a volume shadow copy (e.g., '\HarddiskVolumeShadowCopy') and the SAM file path ('System32\config\sam'), combined with common PowerShell copy commands or .NET file copy methods. This activity is indicative of an adversary trying to extract credentials by accessing the SAM database, often from a shadow copy to bypass file locks.
This rule detects suspicious invocations of PowerShell or PowerShell Core (pwsh.exe) when the parent process is a script engine like wscript.exe or cscript.exe. This behavior is often associated with adversaries using scripting languages to execute PowerShell commands, potentially bypassing direct PowerShell execution policies or obfuscating their activities. The rule specifically filters out legitimate activity from 'Health Service State' to reduce false positives.
Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual". This activity can be indicative of an adversary attempting to impair defenses or achieve persistence by modifying service configurations.
This rule detects suspicious PowerShell command-line patterns indicative of downloading and executing remote content. Specifically, it looks for the use of `IEX (New-Object Net.WebClient).DownloadString` or `(New-Object System.Net.WebClient).DownloadFile` which are commonly abused by malicious scripts, stagers, and downloaders to fetch and run payloads from the internet.
Detects PowerShell command line contents that include suspicious abnormal casing in the 'Net.Webclient' string (e.g., 'nEt.WEbCliEnT') as used in obfuscation techniques. This rule specifically looks for base64 encoded variations of 'Net.Webclient' with mixed casing, indicating an attempt to evade detection.
Detects the use of the PowerShell Get-ADUser cmdlet to enumerate Active Directory user information and export it to a file or pipe it to other cmdlets for further processing, which can be indicative of reconnaissance or data staging by an attacker.
Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files and bypass application allowlisting.
This rule detects the use of "ProtocolHandler.exe" to download files from the internet. "ProtocolHandler.exe" is a legitimate Windows binary that can be abused to download files, often placing them in the Internet Explorer cache folder. The detection specifically looks for the execution of "ProtocolHandler.exe" combined with command-line arguments containing common internet protocols like 'ftp://', 'http://', or 'https://'. This behavior is indicative of System Binary Proxy Execution (T1218) where a trusted binary is used to perform malicious actions, potentially bypassing security controls.
Detects suspicious child processes spawned by "provlaunch.exe". This behavior indicates potential abuse of "provlaunch.exe" for proxy execution, where a legitimate signed binary is used to execute other malicious or suspicious binaries, often for defense evasion. The rule specifically looks for common Windows utilities or executables in suspicious temporary or user-writable directories being launched as children.
Detects the execution of 'ditsnap.exe', a tool used to inspect the Active Directory database (ntds.dit). This tool can be used by adversaries to dump credentials from a domain controller.
Page 565 of 680