SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,706 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious modifications to a Windows service's Discretionary Access Control List (DACL) using 'sc.exe' to deny access to critical trustees. This technique can be used by adversaries to hide services, make them unstoppable, or achieve persistence and privilege escalation by preventing legitimate users or administrators from managing the service.
Detects the creation of a scheduled task where the task name (`/TN`) is a GUID-like string. This behavior is often observed in malware or advanced persistent threats to maintain persistence or execute malicious code, as using GUIDs can help obfuscate the task's purpose or make it less conspicuous among legitimate tasks.
Detects the addition of users to the local 'Remote Desktop Users' group using either the 'net localgroup' command or the 'Add-LocalGroupMember' PowerShell cmdlet. This activity can indicate an adversary attempting to establish persistence or facilitate lateral movement via Remote Desktop Protocol.
Detects the usage of wmic.exe to manipulate Windows registry via the WMI StdRegProv class. This behavior could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe. Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.
Detects the creation of the 'UserInitMprLogonScript' registry value, which can be leveraged by adversaries to establish persistence on a system. This registry key is designed to execute a script upon user logon, making it a valuable target for malicious actors seeking to maintain access.
Detects modifications to specific registry keys under `SYSTEM\CurrentControlSet\Control` that are commonly used for autostart extensibility points (ASEPs). These modifications can indicate persistence mechanisms being established by adversaries.
Detects modifications to various autostart extensibility points (ASEPs) within the Windows Registry's CurrentVersion key. This rule specifically looks for changes to common Run, RunOnce, RunServices, ShellServiceObjectDelayLoad, and other related keys that are frequently abused for persistence and privilege escalation. The rule includes extensive filters for known legitimate software and system processes to reduce false positives.
Detects changes to the default RDP port (3389) in the Windows Registry. Adversaries may modify the RDP port to maintain persistence or evade detection, as this change can allow them to continue using RDP for remote access on a non-standard port.
Detects registry changes to Office trust records where the path is located in a potentially suspicious location, indicating that a macro-enabled document from an unusual or untrusted location has been allowed to run. This could be indicative of an attempt to bypass security controls by executing malicious macros from temporary folders, internet caches, or public user directories.
Detects registry modifications that disable internal tools or functions in explorer, a technique often used by malware like Agent Tesla to hinder user interaction or hide malicious activities.
Page 235 of 680