SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,716 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the use of 'regini.exe' to modify registry keys by importing an alternate data stream. This technique can be used for persistence, defense evasion, or other malicious activities by adversaries.
Detects the execution of 'regsvr32.exe' attempting to load a DLL with an uncommon or unrecognized file extension. This behavior is often associated with defense evasion techniques where adversaries use legitimate Windows binaries to proxy execution of malicious code, bypassing application whitelisting or other security controls.
Detects the creation of scheduled tasks using 'schtasks.exe' that are configured to run only once and involve a temporary folder in their command line. This behavior can be indicative of an adversary establishing temporary persistence or execution mechanisms, often seen in post-exploitation activities.
Detects the creation of a scheduled task that uses PowerShell to retrieve and execute a payload stored in the Windows Registry. This technique is often used for persistence and privilege escalation by malware like Qbot.
Detects the creation of scheduled tasks using `schtasks.exe` where the command line arguments include names of common Windows system processes. This behavior can indicate an adversary attempting to masquerade a malicious scheduled task as a legitimate system process for persistence or privilege escalation.
This rule detects the use of 'fodhelper.exe' as a parent process. Fodhelper.exe is a legitimate Windows utility that can be abused to bypass User Account Control (UAC) and execute processes with elevated privileges without prompting the user. Adversaries commonly leverage this technique for privilege escalation and defense evasion.
Detects modifications to specific autostart extensibility points (ASEPs) within the Wow6432Node Classes registry path. These registry keys are often abused by adversaries to establish persistence or elevate privileges by ensuring their malicious code executes upon system startup or user logon.
Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events. Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing. Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.
This rule detects modifications to the 'ObjectName' registry value for the Windows FAX service. Specifically, it triggers when the 'ObjectName' value is changed from anything other than 'NetworkService'. This change could indicate an adversary attempting to escalate privileges or establish persistence by associating the FAX service with a different user account, potentially one with higher privileges or a compromised account, to execute malicious code or maintain access.
Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode.
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
Page 249 of 680