Rule Library

Sigma Rules

794 rules found for "Microsoft"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionmediumtest

Potential DLL Sideloading Of DbgModel.DLL

Detects potential DLL sideloading of "DbgModel.dll"

WindowsImage Load (DLL)
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionT1574.001 · DLL Search Order Hijacking
Gary LobermierThu Jul 11windows
Detectionmediumtest

Potential DLL Sideloading Of MpSvc.DLL

Detects potential DLL sideloading of "MpSvc.dll".

WindowsImage Load (DLL)
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionT1574.001 · DLL Search Order Hijacking
Nasreddine Bencherchali (Nextron Systems)+1Thu Jul 11windows
Detectionmediumtest

Potential DLL Sideloading Of MsCorSvc.DLL

Detects potential DLL sideloading of "mscorsvc.dll".

WindowsImage Load (DLL)
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionT1574.001 · DLL Search Order Hijacking
Wietze BeukemaThu Jul 11windows
Detectionhightest

Microsoft Office DLL Sideload

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

WindowsImage Load (DLL)
TA0005 · Defense EvasionTA0003 · PersistenceTA0004 · Privilege EscalationT1574.001 · DLL Search Order Hijacking
Nasreddine Bencherchali (Nextron Systems)+1Wed Aug 17windows
Detectionmediumtest

VMMap Signed Dbghelp.DLL Potential Sideloading

Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.

WindowsImage Load (DLL)
TA0005 · Defense EvasionTA0003 · PersistenceTA0004 · Privilege EscalationT1574.001 · DLL Search Order Hijacking
Nasreddine Bencherchali (Nextron Systems)Tue Sep 05windows
Detectionhightest

VMMap Unsigned Dbghelp.DLL Potential Sideloading

Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.

WindowsImage Load (DLL)
TA0005 · Defense EvasionTA0003 · PersistenceTA0004 · Privilege EscalationT1574.001 · DLL Search Order Hijacking
Nasreddine Bencherchali (Nextron Systems)Fri Jul 28windows
Detectionhightest

Potential Mpclient.DLL Sideloading

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

WindowsImage Load (DLL)
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionT1574.001 · DLL Search Order Hijacking
Bhabesh RajTue Aug 02windows
Detectionmediumexperimental

MMC Loading Script Engines DLLs

Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion.

WindowsImage Load (DLL)
TA0002 · ExecutionTA0005 · Defense EvasionT1059.005 · Visual BasicT1218.014 · MMC
Swachchhanda Shrawan Poudel (Nextron Systems)Wed Feb 05windows
Detectionmediumtest

Suspicious WSMAN Provider Image Loads

Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.

WindowsImage Load (DLL)
TA0002 · ExecutionT1059.001 · PowerShellTA0008 · Lateral MovementT1021.003 · Distributed Component Object Model
Roberto Rodriguez (Cyb3rWard0g)+1Wed Jun 24windows
Detectionhightest

Uncommon Network Connection Initiated By Certutil.EXE

Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads.

WindowsNetwork Connection
TA0011 · Command and ControlT1105 · Ingress Tool Transfer
François Hubaut+1Fri Sep 02windows
Detectionhightest

Outbound Network Connection Initiated By Microsoft Dialer

Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"

WindowsNetwork Connection
TA0002 · ExecutionTA0011 · Command and ControlT1071.001 · Web Protocols
CertainlyPFri Apr 26windows
Detectionmediumtest

Network Connection Initiated To DevTunnels Domain

Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

WindowsNetwork Connection
TA0010 · ExfiltrationTA0011 · Command and ControlT1567.001 · Exfiltration to Code RepositoryT1572 · Protocol Tunneling
Kamran SaifullahMon Nov 20windows
Detectionmediumtest

Office Application Initiated Network Connection To Non-Local IP

Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses. This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292. This rule will require an initial baseline and tuning that is specific to your organization.

WindowsNetwork Connection
TA0002 · ExecutionT1203 · Exploitation for Client Execution
Christopher Peacock+4Wed Nov 10windows
Detectionhightest

Outbound RDP Connections Over Non-Standard Tools

Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.

WindowsNetwork Connection
TA0008 · Lateral MovementT1021.001 · Remote Desktop Protocol2013-07-002 · CAR 2013-07-002
Markus NeisWed May 15windows
Detectionmediumtest

Microsoft Sync Center Suspicious Network Connections

Detects suspicious connections from Microsoft Sync Center to non-private IPs.

WindowsNetwork Connection
TA0004 · Privilege EscalationT1055 · Process InjectionT1218 · System Binary Proxy ExecutionTA0002 · Execution+1
elhoimThu Apr 28windows
Detectionmediumtest

Outbound Network Connection To Public IP Via Winlogon

Detects a "winlogon.exe" process that initiate network communications with public IP addresses

WindowsNetwork Connection
TA0005 · Defense EvasionTA0002 · ExecutionTA0011 · Command and ControlT1218.011 · Rundll32
Christopher Peacock+1Fri Apr 28windows
Detectionmediumtest

PUA - PAExec Default Named Pipe

Detects PAExec default named pipe

WindowsNamed Pipe Created
TA0002 · ExecutionT1569.002 · Service Execution
Nasreddine Bencherchali (Nextron Systems)Wed Oct 26windows
Detectionmediumtest

Potential Active Directory Enumeration Using AD Module - PsModule

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

WindowsPowerShell Module
TA0043 · ReconnaissanceTA0007 · DiscoveryTA0040 · Impact
Nasreddine Bencherchali (Nextron Systems)+1Sun Jan 22windows
Detectionmediumtest

Suspicious PowerShell Download - PoshModule

Detects suspicious PowerShell download command

WindowsPowerShell Module
TA0002 · ExecutionT1059.001 · PowerShell
Florian Roth (Nextron Systems)Sun Mar 05windows
Detectionmediumtest

Suspicious Computer Machine Password by PowerShell

The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain. You can use it to reset the password of the local computer.

WindowsPowerShell Module
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionTA0001 · Initial Access+1
François HubautMon Feb 21windows
Detectionmediumtest

Potential Active Directory Enumeration Using AD Module - PsScript

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

WindowsPowerShell Script
TA0043 · ReconnaissanceTA0007 · DiscoveryTA0040 · Impact
François Hubaut+1Sun Jan 22windows
Detectionhightest

Powershell Add Name Resolution Policy Table Rule

Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace. This will bypass the default DNS server and uses a specified server for answering the query.

WindowsPowerShell Script
TA0040 · ImpactT1565 · Data Manipulation
Borna TalebiTue Sep 14windows
Detectionmediumtest

Add Windows Capability Via PowerShell Script

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

WindowsPowerShell Script
TA0002 · Execution
Nasreddine Bencherchali (Nextron Systems)Sun Jan 22windows
Detectionmediumtest

Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

WindowsPowerShell Script
TA0007 · DiscoveryT1033 · System Owner/User Discovery
Nasreddine Bencherchali (Nextron Systems)Thu Nov 17windows
Detectionmediumtest

Registry-Free Process Scope COR_PROFILER

Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR. (Citation: Microsoft Profiling Mar 2017) (Citation: Microsoft COR_PROFILER Feb 2013)

WindowsPowerShell Script
TA0004 · Privilege EscalationTA0005 · Defense EvasionTA0003 · PersistenceT1574.012 · COR_PROFILER
François HubautThu Dec 30windows
Detectionhightest

Create Volume Shadow Copy with Powershell

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information

WindowsPowerShell Script
TA0006 · Credential AccessT1003.003 · NTDSattack.ds0005
François HubautWed Jan 12windows
Detectionmediumtest

Manipulation of User Computer or Group Security Principals Across AD

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..

WindowsPowerShell Script
TA0003 · PersistenceT1136.002 · Domain Account
François HubautTue Dec 28windows
Detectionhightest

Disable-WindowsOptionalFeature Command PowerShell

Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

WindowsPowerShell Script
TA0005 · Defense EvasionT1562.001 · Disable or Modify Tools
François HubautSat Sep 10windows
Detectionmediumtest

Potential COM Objects Download Cradles Usage - PS Script

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

WindowsPowerShell Script
TA0011 · Command and ControlT1105 · Ingress Tool Transfer
François HubautSun Dec 25windows
Detectionmediumtest

Enable Windows Remote Management

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

WindowsPowerShell Script
TA0008 · Lateral MovementT1021.006 · Windows Remote Management
François HubautFri Jan 07windows
Detectionmediumtest

Potential Suspicious Windows Feature Enabled

Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

WindowsPowerShell Script
TA0005 · Defense Evasion
François HubautSat Sep 10windows
Detectionmediumtest

Certificate Exported Via PowerShell - ScriptBlock

Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

WindowsPowerShell Script
TA0006 · Credential AccessT1552.004 · Private Keys
Florian Roth (Nextron Systems)Fri Apr 23windows
Detectionmediumtest

Service Registry Permissions Weakness Check

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

WindowsPowerShell Script
TA0004 · Privilege EscalationTA0005 · Defense EvasionTA0003 · PersistenceT1574.011 · Services Registry Permissions Weakness+1
François HubautThu Dec 30windows
Detectionlowtest

Active Directory Computers Enumeration With Get-AdComputer

Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.

WindowsPowerShell Script
TA0007 · DiscoveryT1018 · Remote System DiscoveryT1087.002 · Domain Account
François HubautThu Mar 17windows
Detectionmediumtest

Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript

Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages

WindowsPowerShell Script
TA0003 · PersistenceTA0005 · Defense Evasion
Nasreddine Bencherchali (Nextron Systems)Tue Jan 31windows
Detectionmediumtest

Execute Invoke-command on Remote Host

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

WindowsPowerShell Script
TA0008 · Lateral MovementT1021.006 · Windows Remote Management
François HubautFri Jan 07windows
Detectionmediumtest

Powershell LocalAccount Manipulation

Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups

WindowsPowerShell Script
TA0004 · Privilege EscalationTA0003 · PersistenceT1098 · Account Manipulation
François HubautTue Dec 28windows
Detectionhightest

Live Memory Dump Using Powershell

Detects usage of a PowerShell command to dump the live memory of a Windows machine

WindowsPowerShell Script
TA0006 · Credential AccessT1003 · OS Credential Dumping
Max Altgelt (Nextron Systems)Tue Sep 21windows
Detectionmediumtest

Powershell MsXml COM Object

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code

WindowsPowerShell Script
TA0002 · ExecutionT1059.001 · PowerShell
François Hubaut+1Wed Jan 19windows
Detectionhightest

Code Executed Via Office Add-in XLL File

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs

WindowsPowerShell Script
TA0003 · PersistenceT1137.006 · Add-ins
François HubautTue Dec 28windows
Detectionmediumexperimental

Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock

Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.

WindowsPowerShell Script
TA0043 · ReconnaissanceTA0007 · DiscoveryTA0006 · Credential AccessT1018 · Remote System Discovery+2
François HubautWed Mar 05windows
Detectionhightest

PowerShell Web Access Installation - PsScript

Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse

WindowsPowerShell Script
TA0003 · PersistenceTA0002 · ExecutionT1059.001 · PowerShell
Michael HaagTue Sep 03windows
Detectionmediumtest

PowerShell Remote Session Creation

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system

WindowsPowerShell Script
TA0002 · ExecutionT1059.001 · PowerShell
François HubautThu Jan 06windows
Detectionhightest

Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock

Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets. This behavior is typically seen during a Kerberos or silver ticket attack. A successful execution will output the SPNs for the endpoint in question.

WindowsPowerShell Script
TA0006 · Credential AccessT1558.003 · Kerberoasting
François HubautTue Dec 28windows
Detectionmediumtest

Suspicious Invoke-Item From Mount-DiskImage

Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.

WindowsPowerShell Script
TA0005 · Defense EvasionT1553.005 · Mark-of-the-Web Bypass
François HubautTue Feb 01windows
Detectionlowtest

PowerShell Script With File Upload Capabilities

Detects PowerShell scripts leveraging the "Invoke-WebRequest" cmdlet to send data via either "PUT" or "POST" method.

WindowsPowerShell Script
TA0010 · ExfiltrationT1020 · Automated Exfiltration
François HubautFri Jan 07windows
Detectionhightest

PowerShell Set-Acl On Windows Folder - PsScript

Detects PowerShell scripts to set the ACL to a file in the Windows folder

WindowsPowerShell Script
TA0005 · Defense Evasionattack.t1222
François Hubaut+1Tue Jul 18windows
Detectionmediumtest

Change PowerShell Policies to an Insecure Level - PowerShell

Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.

WindowsPowerShell Script
TA0002 · ExecutionT1059.001 · PowerShell
François HubautWed Oct 20windows