SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,700 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects attempts to disable Event Tracing for Windows (ETW) logging within .NET processes by modifying specific registry keys. Adversaries may perform this action to evade detection by security tools that rely on ETW for monitoring .NET activity. The rule specifically looks for modifications to the 'ETWEnabled' and 'ETWFlags' registry keys under 'SOFTWARE\Microsoft\.NETFramework' or 'COMPlus_' prefixed keys, setting their values to '0' (disabled). This indicates an attempt to prevent the recording of loaded .NET assemblies and other relevant ETW events, thereby hindering security monitoring capabilities.
Monitors for the creation or modification of scheduled tasks in the Windows registry by processes other than common legitimate ones like svchost.exe. This can indicate an adversary establishing persistence or executing malicious code via scheduled tasks.
Detects the execution of Windows Credential Editor (WCE), a post-exploitation tool used to extract plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory. This tool is commonly employed by threat actors for credential dumping and facilitating lateral movement within compromised networks.
Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. Adversaries may delete this key to cover their tracks after executing commands, especially in scenarios like clickfix techniques where users are lured into executing malicious commands via the run dialog.
Detects the creation of a specific PowerShell module file ('webAdministration.psm1') within the WindowsPowerShell Modules directory, which is indicative of an attempt to exploit CVE-2022-24527, a local privilege escalation vulnerability in Microsoft Connected Cache. The rule filters out activity by authorized users to reduce false positives.
Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024. Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.
Detects the setting of a new value in the Windows Registry Run key that is used by the Kapeka backdoor for persistence. Specifically, it looks for entries in `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` that end with `\Sens Api` or `\OneDrive` and contain `rundll32.exe`, `.wll`, and `#1` in their details, which are indicators of Kapeka's persistence mechanism.
This rule detects the creation of scheduled tasks using `schtasks.exe` where the parent process originates from a suspicious temporary or user-specific directory. Adversaries often use scheduled tasks for persistence and privilege escalation, and executing the task creation utility from locations like `Temp`, `AppData\Local`, `AppData\Roaming`, `Temporary Internet Files`, or `Users\Public` can indicate malicious activity. Multiple malware strains have been observed employing this technique.
Detects the setting of a registry value within the `\Shell\Open\Command` key using PowerShell classes from the `System.Security.Cryptography` namespace. This technique can be used by adversaries for defense evasion, for example, to decrypt malicious payloads on the fly.
This rule detects login attempts against the Telnet service running on an OpenCanary honeypot. OpenCanary is designed to attract and detect unauthorized access attempts, so any login attempt to its Telnet service indicates potential malicious activity or reconnaissance against the honeypot.
Page 227 of 680