SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,706 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. This activity is often used to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.
Detects instances where the Windows Installer service (msiexec.exe) spawns command-line interpreters like cmd.exe or PowerShell.exe. This behavior is often associated with the 'AlwaysInstallElevated' policy being enabled, which can lead to privilege escalation.
Detects modifications to specific registry keys related to NetNTLM authentication settings. These modifications can indicate an attempt to downgrade NetNTLM security, potentially enabling NetNTLM downgrade attacks. The rule specifically looks for changes to 'lmcompatibilitylevel', 'NtlmMinClientSec', and 'RestrictSendingNTLMTraffic' within the LSA registry path to less secure values.
Detects the creation or modification of registry keys associated with Windows Assistive Technology applications, specifically focusing on changes to the 'ATs' and 'Configuration' keys under 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility'. This activity can be indicative of persistence or privilege escalation attempts by adversaries abusing accessibility features like 'atbroker.exe'. The rule includes filters to reduce false positives from legitimate 'atbroker.exe' activity or MSI installers.
Detects modifications to specific autostart extensibility points (ASEPs) within the Windows Registry's Session Manager key. These modifications can be used by adversaries to establish persistence or elevate privileges by ensuring malicious code is executed during system boot or user logon. The rule specifically targets changes to 'SetupExecute', 'S0InitialCommand', 'KnownDlls', 'Execute', 'BootExecute', and 'AppCertDlls' values under the 'System\CurrentControlSet\Control\Session Manager' path.
Detects modifications to specific Windows Registry keys under the `Wow6432Node\Microsoft\Windows NT\CurrentVersion` path, which are commonly used for autostart extensibility points (ASEPs). Specifically, it looks for changes to `Appinit_Dlls` and `Image File Execution Options` which can be abused for persistence or privilege escalation.
This rule detects modifications to the Windows Registry keys associated with Application Shimming. Adversaries may use application shims to establish persistence and/or elevate privileges by executing malicious content. The rule specifically looks for changes within the 'InstalledSDB' and 'Custom' AppCompatFlags registry paths, which are used to store information about installed shim databases.
This rule detects modifications to the Windows Registry key `HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential` where its value is set to `0x00000001`. This modification enables the WDigest protocol to store clear-text credentials in memory, making them vulnerable to credential dumping attacks. Adversaries often enable this setting to facilitate the extraction of user credentials from the Local Security Authority Subsystem Service (LSASS) process.
This rule detects potential DLL sideloading attempts using the 'coregen.exe' (Microsoft CoreCLR Native Image Generator) binary. It specifically looks for instances where 'coregen.exe' loads DLLs from locations other than the legitimate Microsoft Silverlight or Windows system directories (System32, SysWOW64). This behavior can indicate an adversary attempting to execute malicious code by tricking a legitimate, signed Microsoft binary into loading their arbitrary DLL.
Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe".
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".
Page 233 of 680