SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,625 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detect changes to the "PendingFileRenameOperations" registry key from uncommon or suspicious images locations to stage currently used files for rename or deletion after reboot.
Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persistence.
Generally, modifications to the `*\shell\open\command` registry key can indicate an attempt to change the default action for opening files,
and various UAC bypass or persistence techniques involve modifying these keys to execute malicious scripts or binaries.
Generally, modifications to the `*\shell\open\command` registry key can indicate an attempt to change the default action for opening files,
and various UAC bypass or persistence techniques involve modifying these keys to execute malicious scripts or binaries.
Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages.
Detects UAC bypass method using Windows event viewer
UAC Bypass via Sdclt
Sigma
Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)
Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)
Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)
Triggers on any Sysmon "FileBlockShredding" event, which indicates a violation of the configured shredding policy.
Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command
Detects usage of an encoded/obfuscated version of an IP address (hex, octal, etc.) via command line
Page 151 of 680