SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,717 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects changes to the Windows EventLog channel permission values by monitoring modifications to the Security Descriptor Definition Language (SDDL) string in the registry. Such modifications can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify an event log channel. This action can prevent users from accessing the event log channel via Event Viewer or utilities like "Get-EventLog" or "wevtutil".
Detects when the 'DisallowRun' registry value is set to '1' under 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'. This registry setting prevents users from running specified computer programs, which can be used by adversaries for defense evasion or to restrict user capabilities.
This rule detects modifications to the Windows Registry related to Fax Device Providers, specifically looking for changes to the 'ImageName' value within the 'Software\Microsoft\Fax\Device Providers\' path. This technique can be used for persistence by loading a malicious DLL when the Fax service restarts, as highlighted in the provided references.
This rule detects attempts to modify the 'ServiceDll' registry value for the 'wercplsupport' service. This specific modification is associated with the Blue Mockingbird cryptominer, which uses this technique for persistence by hijacking a legitimate service to load its malicious DLL.
Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.
Detects when the Microsoft Outlook security setting for macro execution is modified to allow macros to run without warning. This change can enable malicious macros to execute automatically, potentially leading to persistence, privilege escalation, or further compromise.
This rule detects potential persistence mechanisms leveraging the Appx DebugPath feature in Windows. Adversaries can modify specific registry keys related to Universal Windows Platform (UWP) applications to inject a malicious DebugPath, which then executes their code when the associated application is launched. The rule specifically looks for modifications to the 'DebugPath' value within 'Classes\ActivatableClasses\Package\Microsoft.' registry paths or the default value within '\Software\Microsoft\Windows\CurrentVersion\PackagedAppXDebug\Microsoft.' paths.
This rule detects modifications to Internet Explorer registry settings, which attackers can abuse for persistence or defense evasion. Specifically, it looks for changes within the 'Software\Microsoft\Windows\CurrentVersion\Internet Settings' registry path. Potential malicious activities include adding domains to the Trusted Sites Zone or injecting JavaScript for persistence. The rule filters out common benign modifications related to DWORD values, Office applications, cache, ZoneMap, WpadDecision paths, binary data, and changes made by 'RuntimeBroker.exe' or within 'Accepted Documents' to reduce false positives.
Detects the creation or modification of registry run keys to include PowerShell commands or scripts. This technique is commonly used for persistence and privilege escalation, allowing malicious code to execute automatically when a user logs in. The rule specifically looks for common PowerShell keywords and command-line arguments often associated with malicious activity, such as hidden windows, encoded commands, execution policy bypass, and various Invoke- commands for web requests or expression evaluation.
This rule detects attempts to disable Event Tracing for Windows (ETW) logging specifically for the Service Control Manager (SCM) by modifying the 'TracingDisabled' registry key. Adversaries may do this to impair defensive capabilities and hide their activities, as ETW logs are crucial for security monitoring and incident response.
Page 247 of 680