SigmaHQ Detections
@sigmaHQ12 followers122,466 downloads2,593 copies16 likes160,477 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for an Active Directory domain.
Detects the use of PowerShell to identify the current logged user.
Detect use of Get-GPO to get one GPO or all the GPOs in a domain.
Get the processes that are running on the local computer.
Detects suspicious PowerShell invocation command parameters
Detects PowerShell scripts that contains reference to keystroke capturing functions
Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.
Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism
Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.
Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.
Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
Page 645 of 680