SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,496 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the use of 'netsh.exe' to modify Microsoft Defender Firewall rules. Specifically, it looks for command-line arguments that indicate the setting of a new firewall rule with 'group=' and 'enable=Yes', which could be used by adversaries to bypass network controls.
Detects suspicious PowerShell code that is UTF16 and base64 encoded, often used in command lines for obfuscation. The rule specifically looks for patterns indicative of obfuscated PowerShell, such as '-bxor 0x', '.Invoke() |', and format string patterns like '{1}{0}" -f' or '{0}{3}" -f' in their encoded forms.
This rule detects PowerShell command lines that exhibit characteristics of obfuscation by looking for repeated special characters such as '+', '{', '^', and '`'. These patterns are commonly used by adversaries to evade detection by making the command less readable or to bypass signature-based defenses. The rule specifically targets PowerShell (powershell.exe) and PowerShell Core (pwsh.exe) processes.
This rule detects attempts to disable the Windows Firewall using PowerShell. It specifically looks for PowerShell process creations that include commands to set the NetFirewallProfile to 'False' for any profile ('All', 'Public', 'Domain', or 'Private'). This activity is often performed by adversaries to bypass host-based firewalls and facilitate further malicious activity.
This rule detects attempts to disable Windows Defender's security monitoring features using PowerShell or the 'sc.exe' utility. Specifically, it looks for PowerShell commands that include '-DisableBehaviorMonitoring $true' or '-DisableRuntimeMonitoring $true'. It also identifies 'sc.exe' commands used to stop, delete, or disable the 'WinDefend' service (Windows Defender Antivirus Service). This activity is indicative of an adversary trying to impair defenses to avoid detection.
Detects the usage of COM objects within PowerShell commands that can be leveraged to download files. This rule specifically looks for the `[Type]::GetTypeFromCLSID(` method combined with known Class IDs (CLSIDs) associated with objects capable of file downloads.
This rule detects the use of PowerShell's `Get-Process` cmdlet or its aliases (`ps`, `gps`) specifically targeting the `lsass` process. Accessing the `lsass` process memory is a common technique used by attackers to dump credentials, making this activity highly suspicious and indicative of potential credential theft.
Detects PowerShell scripts attempting to import modules from suspicious directories such as temporary folders or publicly accessible user directories. This behavior can indicate an attempt to execute malicious code or evade detection by using non-standard module locations.
Detects the use of PowerShell cmdlets 'Add-AppxPackage' or 'Add-AppPackage' with the '-AllowUnsigned' flag to install unsigned AppX packages. This activity can be indicative of an adversary attempting to establish persistence or evade defenses by installing malicious applications that are not signed by a trusted authority.
Detects attempts to remove or modify Windows Defender configurations using the 'Remove-MpPreference' cmdlet, specifically targeting settings related to Controlled Folder Access and Attack Surface Reduction Rules. This activity is often indicative of an adversary trying to disable security features to facilitate further malicious actions.
Page 579 of 680