SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,712 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects a registry modification that disables security warnings for Microsoft Office macros, specifically setting the 'VBAWarnings' registry value to '1'. This configuration allows the execution of all macros, whether signed or unsigned, which can be abused by attackers for initial access, persistence, or defense evasion.
Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism.
Detects potential persistence activity by monitoring the registration of new custom protocol handlers in the Windows Registry. Attackers can abuse this mechanism to establish persistence by setting a custom handler to execute malicious code when a specific URI scheme is accessed. The rule filters out common legitimate Microsoft protocols and applications installed in standard program file locations to reduce false positives.
Detects the creation or modification of a Registry Run key specifically for Windows Explorer, where the value points to suspicious locations such as the Recycle Bin, ProgramData, Temp directories, or Public/Default user profiles. This is a common technique used by adversaries to establish persistence on a system, ensuring their malicious code executes upon user login.
Detects potential persistence behavior by monitoring modifications to the Windows TelemetryController registry key. Adversaries can abuse the `CompatTelRunner.exe` binary, which is used by Windows telemetry, to execute arbitrary commands specified in the registry. This rule specifically looks for modifications to the `TelemetryController` subkey where the `Command` value is set to execute common executable file types.
Detects attempts to freeze a process, likely an EDR or an antimalware service process, through EDR-Freeze that abuses the WerFaultSecure.exe process to suspend security software. The rule specifically looks for WerFaultSecure.exe being executed with a particular set of command-line arguments that are indicative of the EDR-Freeze tool's behavior, including '/h', '/pid', '/tid', '/encfile', '/cancel', '/type', and '268310'.
This rule detects attempts to search for JSON Web Tokens (JWTs) via command-line interface (CLI) tools. It specifically looks for common JWT header prefixes ('eyJ0eXAiOi' and 'eyJhbGciOi') within command-line arguments of tools like 'find', 'findstr', 'select-string', and 'strings'. Threat actors often search for these tokens to steal them for purposes such as lateral movement or privilege escalation, as JWTs are widely used for authentication and authorization in various applications and services (e.g., Microsoft 365, Azure, AWS, Google Cloud).
Detects potential DLL sideloading of "DbgModel.dll" when it is loaded from a non-standard or unexpected directory. This rule specifically filters out legitimate loads from common Windows system directories and known application paths like WinDbg and Windows Kits.
This rule detects potential DLL sideloading of "edputil.dll". It specifically looks for instances where "edputil.dll" is loaded from a directory that is not a standard Windows system directory (C:\Windows\System32\, C:\Windows\SysWOW64\, or C:\Windows\WinSxS\). This behavior can indicate an adversary attempting to execute malicious code by tricking a legitimate application into loading a malicious DLL instead of the legitimate one.
Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe. This rule aims to identify instances where this specific DLL is loaded from unexpected or non-standard locations, which could indicate malicious activity such as persistence, defense evasion, or privilege escalation through DLL sideloading.
Page 242 of 680