SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,620 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potentially suspicious execution of the Regasm/Regsvcs utilities with an uncommon extension.
Detects potentially suspicious execution of the Regasm/Regsvcs utilities from a potentially suspicious location
Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe
Detects using register-cimprovider.exe to execute arbitrary dll file.
Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.
Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" which should be uncommon.
Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.
Detects execution of regsvr32 where the DLL is located in a potentially suspicious location.
Page 134 of 680