SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,506 copies16 likes159,710 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when the 'fAllowToGetHelp' registry value is set to 1, which enables the Remote Assistance feature on a Windows machine. This allows a specific user to establish an RDP connection for remote assistance.
Detects modifications to autostart extensibility points (ASEP) within the Windows Registry, specifically focusing on keys under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion' that are commonly used for persistence. This includes modifications to Winlogon, Windows, Image File Execution Options, Font Drivers, and Drivers32 subkeys. The rule includes filters for known legitimate activities by Microsoft Edge, Microsoft Office, OneDrive, Avira, and .NET Framework's NGEN.
Detects the modification of a registry value under `\Software\Winternals\BGInfo\UserFields\` where the `Details` field starts with '6', indicating a custom WMI query. This activity can be abused by adversaries to execute arbitrary WMI queries via BgInfo.exe, potentially leading to persistence or defense evasion.
Detects the modification or creation of the 'Database' registry value under 'Software\Winternals\BGInfo' which can be used by attackers to specify an external database path for BgInfo. This could be leveraged to exfiltrate information collected by BgInfo by directing it to a controlled location.
This rule detects modifications to specific autostart extensibility points (ASEPs) within the `Wow6432Node` path of the Windows registry. These registry keys are commonly used by legitimate applications for persistence, but also by adversaries to establish persistence or elevate privileges by ensuring their malicious code executes upon user login or system startup. The rule specifically targets modifications under `HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion` for keys like `Run`, `RunOnce`, `ShellServiceObjectDelayLoad`, and various `Explorer` related autostart locations.
This rule detects modifications to the Windows Registry keys responsible for DHCP server Callout DLLs. Attackers can leverage this mechanism to install malicious DLLs that execute in the context of the DHCP server, leading to privilege escalation, persistence, and defense evasion. The rule specifically looks for changes to the 'CalloutDlls' and 'CalloutEnabled' values under the 'HKLM\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters' path.
Detects registry modifications that disable or change features of internal Windows tools, often used by malware for defense evasion or persistence. This includes disabling command prompt, control panel, run dialog, task manager, user account control (UAC) prompts, write protection, and notification center.
This rule detects modifications to the "DsrmAdminLogonBehavior" registry value. Attackers may modify this value to abuse the Directory Services Restore Mode (DSRM) administrator account for persistence and access to Active Directory. The DSRM account is a local administrator account on a Domain Controller, typically used for restoring AD backups or recovering from failures. By changing "DsrmAdminLogonBehavior" from its default value of '0' (only usable in DSRM) to '1' (usable when AD DS service is stopped) or '2' (always usable), attackers can gain persistent access to the Domain Controller outside of DSRM, facilitating credential access and defense evasion.
Detects registry modifications that hide internal tools or functions from the user, a technique often employed by malware such as Agent Tesla and Hermetic Wiper. The rule specifically looks for changes to registry keys related to hiding clock, health, network, power, and volume icons in the system tray, as well as disabling advanced explorer features like showing info tips or compressed file colors.
Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper.
Page 241 of 680