SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,506 copies16 likes159,711 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the use of the 'reg.exe' command-line tool to add entries to specific Windows Registry Run keys. These Run keys are commonly used by adversaries to establish persistence, ensuring that a malicious program executes automatically when a user logs in. The rule specifically looks for 'reg.exe' being executed with 'add' command and targeting 'Software\Microsoft\Windows\CurrentVersion\Run', 'Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run', or 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run' registry paths.
Detects the modification of the Local Security Authority (LSA) configuration to register a malicious password filter DLL. This is achieved by looking for command-line arguments that attempt to add or modify registry keys under 'HKLM\SYSTEM\CurrentControlSet\Control\Lsa' related to password filters, specifically involving 'scecli' and 'reg add'. This technique is often used by adversaries to harvest credentials.
Detects changes to the "DisableRestrictedAdmin" registry value via process creation events. This registry value controls RestrictedAdmin mode, which prevents the transmission of reusable credentials to a remote system during Remote Desktop connections, thereby mitigating credential harvesting if the remote server is compromised. This rule specifically looks for command-line arguments that indicate an attempt to modify this registry key.
This rule detects attempts to modify Remote Desktop Protocol (RDP) related registry keys using the `reg.exe` utility. Specifically, it looks for command-line executions of `reg.exe` that add or modify values within the `CurrentControlSet\Control\Terminal Server` registry path. The rule targets modifications related to RDP licensing, concurrent sessions, WinStation configurations (like `MaxInstanceCount`, `fEnableWinStation`, `TSUserEnabled`, `TSEnabled`, `TSAppCompat`, `IdleWinStationPoolCount`, `TSAdvertise`, `AllowTSConnections`, `fSingleSessionPerUser`, `fDenyTSConnections`), which could indicate an adversary enabling or reconfiguring RDP for persistence, lateral movement, or defense evasion.
Detects when 'regedit.exe' is launched with elevated privileges by either 'TrustedInstaller.exe' or 'ProcessHacker.exe'. This activity is highly suspicious as it indicates an attempt to modify the registry with system-level permissions, potentially for defense evasion or privilege escalation.
Detects the use of 'regedit.exe' to import a registry file that originates from an Alternate Data Stream (ADS). This technique can be used by adversaries for persistence, defense evasion, or to modify system configurations by importing registry keys from hidden data streams.
Detects attempts to modify critical service configuration registry keys (ImagePath, FailureCommand, and ServiceDll) by processes running with a 'Medium' integrity level. This activity can indicate a privilege escalation attempt where an attacker with medium integrity tries to alter service execution to gain higher privileges or establish persistence.
Detects the execution of 'regini.exe', a legitimate Windows utility that can be used to modify registry keys by importing changes from one or more text files. This activity can be indicative of an adversary attempting to alter system configurations, achieve persistence, or evade defenses by manipulating the Windows Registry.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. This specific command line indicates that TeamViewer_Desktop.exe is being launched by TeamViewer_Service.exe with an IPC port of 5939 and module 1, which is characteristic of a remote connection being established. An investigator can verify connection details by reviewing the "incoming_connections.txt" log file in the TeamViewer folder.
This rule detects when 'sdclt.exe' (System Data Collector) spawns any child processes. This behavior is often associated with User Account Control (UAC) bypass techniques, where sdclt.exe is leveraged to execute arbitrary code with elevated privileges without triggering a UAC prompt. The rule is a general indicator of such activity.
Page 239 of 680