Rule Library
Sigma Rules
3 rules found for "Nikita Nazarov"
3,707Total
3,116Detection
451Emerging
137Hunting
Threat Huntmediumtest
Remote Thread Creation Via PowerShell
Detects the creation of a remote thread from a Powershell process to another process
WindowsRemote Thread Creation
TA0002 · ExecutionT1059.001 · PowerShelldetection.threat-hunting
Nikita Nazarov+1Tue Oct 06windows
Threat Huntmediumtest
WinAPI Library Calls Via PowerShell Scripts
Detects calls to WinAPI libraries from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.
WindowsPowerShell Script
TA0002 · ExecutionT1059.001 · PowerShellT1106 · Native APIdetection.threat-hunting
Nikita Nazarov+2Fri Jul 21windows
Threat Huntmediumtest
WinAPI Function Calls Via PowerShell Scripts
Detects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.
WindowsPowerShell Script
TA0002 · ExecutionT1059.001 · PowerShellT1106 · Native APIdetection.threat-hunting
Nikita Nazarov+2Fri Jul 21windows