SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,696 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects an unexpected process spawning from dns.exe, which may indicate activity related to remote code execution or other forms of exploitation, specifically referencing CVE-2020-1350 (SigRed). The rule filters out legitimate child processes like conhost.exe.
Detects the execution of the hacktool SharPersist, which is used to deploy various persistence mechanisms on Windows systems. The rule specifically identifies SharPersist.exe being executed with command-line arguments indicative of creating scheduled tasks, modifying startup folders, adding registry run keys, or installing new services for persistence.
Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.
This rule detects the creation of a suspicious child process by 'userinit.exe'. Userinit.exe is a legitimate Windows process responsible for initializing the user environment during logon. Malicious actors may attempt to leverage or compromise this process to execute arbitrary code, establish persistence, or elevate privileges. The rule specifically filters out legitimate child processes like 'explorer.exe' and processes related to netlogon to reduce false positives.
Detects the creation or modification of a specific registry key path often used by malware families like IceID and Qakbot for persistence or defense evasion. The rule specifically looks for the registry key ending with '\Software\firm\soft\Name'. This activity has been observed in campaigns distributing malicious OneNote files.
Detects modifications to registry keys associated with Microsoft Office add-ins, which can be used for persistence. Adversaries may abuse these autostart extensibility points (ASEPs) to execute malicious code every time an Office application starts.
This rule detects modifications to the 'DelegateExecute' registry value within the 'HKCU\Software\Classes\Folder\shell\open\command' key. This specific registry modification is a known technique used for COM hijacking, often leveraged in UAC bypasses, such as those involving sdclt.exe. An attacker can modify this key to execute an arbitrary program when a user attempts to open a folder, leading to persistence or privilege escalation.
This rule detects attempts to disable Event Tracing for Windows (ETW) logging within .NET processes by modifying specific registry keys. Adversaries may perform this action to evade detection by security tools that rely on ETW for monitoring .NET activity. The rule specifically looks for modifications to the 'ETWEnabled' and 'ETWFlags' registry keys under 'SOFTWARE\Microsoft\.NETFramework' or 'COMPlus_' prefixed keys, setting their values to '0' (disabled). This indicates an attempt to prevent the recording of loaded .NET assemblies and other relevant ETW events, thereby hindering security monitoring capabilities.
Monitors for the creation or modification of scheduled tasks in the Windows registry by processes other than common legitimate ones like svchost.exe. This can indicate an adversary establishing persistence or executing malicious code via scheduled tasks.
Detects the execution of Windows Credential Editor (WCE), a post-exploitation tool used to extract plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory. This tool is commonly employed by threat actors for credential dumping and facilitating lateral movement within compromised networks.
Page 226 of 680