SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,625 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability
Detects the abuse of the exefile handler in new file association. Used for bypass of security products.
Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to prevent it from loading.
Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism.
Detects potential WerFault "ReflectDebugger" registry value abuse for persistence.
Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information)
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll
Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl
Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.
Page 150 of 680