SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,507 copies16 likes159,711 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects attempts to clear the connection history for Microsoft Terminal Server Client (MSTSC) by deleting specific registry keys or values. This activity can be performed by an attacker to remove forensic evidence of their remote access to a system.
This rule detects the creation or modification of the 'MiniNt' registry key under 'HKLM\SYSTEM\CurrentControlSet\Control\'. The presence of this key, particularly after a system reboot, can prevent the Windows Event Log service from writing events, effectively disabling security event logging. This is a known technique used by adversaries for defense evasion.
This rule detects modifications to the 'Run Once' registry key, specifically targeting the 'StubPath' value within 'Microsoft\Active Setup\Installed Components'. This registry key is often used by legitimate applications for one-time execution tasks, but adversaries can abuse it to establish persistence or execute malicious payloads. The rule includes filters to exclude common legitimate modifications made by Google Chrome and Microsoft Edge installers, which frequently use this mechanism.
Detects the creation or modification of Windows Run keys by executables located in suspicious directories such as user Downloads, temporary Outlook attachments, or Internet Explorer temporary files. This behavior is often indicative of persistence mechanisms used by malware or adversaries.
Detects modifications to common autostart extensibility points (ASEP) in the Windows Registry. These registry keys are frequently used by legitimate software and adversaries to establish persistence by ensuring programs execute automatically upon system boot or user logon. The rule specifically targets a wide range of registry paths associated with autorun functionality, including those for Command Processor, Active Setup, Internet Explorer, and various system services. It includes filters to reduce false positives from known legitimate Microsoft Office, Chrome, Edge, and Internet Explorer activities.
Detects modifications to specific registry keys under the 'Classes' hive that are commonly used as autostart extensibility points (ASEPs). These modifications can be used by adversaries to establish persistence or elevate privileges by ensuring their code executes automatically.
Detects the modification of a registry value related to BgInfo configuration, specifically within the 'UserFields' subkey, where the 'Details' field starts with '4' (indicating a WMI script). This modification can be abused to execute custom VBScript via 'BgInfo.exe', potentially leading to persistence or defense evasion.
Detects modifications to the WinSock2 Parameters registry keys, specifically within Protocol_Catalog9 and NameSpace_Catalog5 entries. These modifications can be used for persistence by adversaries to load malicious code or redirect network traffic.
This rule detects attempts to establish persistence by modifying the "DbgManagedDebugger" registry key within the .NET Framework hive. Adversaries can leverage this mechanism to execute a debugger or any specified executable when a .NET application crashes, effectively achieving persistence or privilege escalation. The rule specifically looks for modifications to the 'Debugger' value under the 'Microsoft\.NETFramework\DbgManagedDebugger' key, while filtering out legitimate modifications made by 'vsjitdebugger.exe'.
Detects when the 'UseActionCenterExperience' registry value is set to 0, which disables Windows Security Center notifications. This can be used by adversaries for defense evasion to prevent users from being alerted to security issues.
Page 246 of 680