Rule Library
Sigma Rules
3 rules found for "Nikita Nazarov"
3,731Total
3,132Detection
457Emerging
139Hunting
Threat Huntmediumtest
Remote Thread Creation Via PowerShell
Detects the creation of a remote thread from a Powershell process to another process
WindowsRemote Thread Creation
Nikita Nazarov+1Tue Oct 06windows
Threat Huntmediumtest
WinAPI Library Calls Via PowerShell Scripts
Detects calls to WinAPI libraries from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.
WindowsPowerShell Script
Nikita Nazarov+2Fri Jul 21windows
Threat Huntmediumtest
WinAPI Function Calls Via PowerShell Scripts
Detects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.
WindowsPowerShell Script
Nikita Nazarov+2Fri Jul 21windows