SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,717 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects changes to the NGenAssemblyUsageLog registry key.
.NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section).
By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.
.NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section).
By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.
Detects modifications to registry keys related to Microsoft Office "Trusted Locations" where an uncommon path is added. Attackers may leverage this to bypass macro security restrictions by adding their malicious document locations as trusted.
Detects changes to the PSFactory COM InProcServer32 registry key, specifically targeting the CLSID {c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}. This technique has been observed being used by the RomCom threat actor to establish persistence by storing a malicious DLL, replacing the legitimate ActXPrxy.dll.
This rule detects potential persistence activity by monitoring modifications to the Outlook Today page settings in the Windows Registry. Attackers can leverage this feature by setting a custom URL in the registry keys `Software\Microsoft\Office\<version>\Outlook\Today\URL` or `Software\Microsoft\Office\<version>\Outlook\Today\UserDefinedUrl`, along with setting the `Stamp` value to `0x00000001`. This allows for the execution of arbitrary code when Outlook is opened, providing a persistent foothold on the system.
This rule detects potential persistence via Component Object Model (COM) hijacking by monitoring modifications to the Windows Registry. Specifically, it looks for changes where the 'InprocServer32\(Default)' key is set to 'C:\WINDOWS\system32\scrobj.dll'. Adversaries can abuse scrobj.dll, which looks for the 'ScriptletURL' key to execute scripts, to maintain persistence on a system.
Detects changes to the "ExtErrorInformation" key in the Windows Registry to disable Event Tracing for Windows (ETW) logging specifically for rpcrt4.dll. This modification can be used by adversaries to impair defenses by hiding their activities related to RPC (Remote Procedure Call) communications.
Detects when the 'Notification_Suppress' registry value is set to 1 under 'SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration'. This action disables Windows Security Center notifications, which can be used by adversaries for defense evasion to prevent users from being alerted to security issues.
Detects modifications to the 'TreatAs' registry key, which can be used for COM Hijacking. This technique allows an attacker to substitute a legitimate COM object with a malicious one, often used for persistence or privilege escalation, particularly when combined with commands like "rundll32.exe -sta". The rule includes filters for common legitimate processes that might modify this key, such as Microsoft Office components, svchost.exe, and msiexec.exe during installations or updates.
This rule detects the use of 'Set-Alias' or 'New-Alias' cmdlets in PowerShell script block logs. Adversaries often use these cmdlets to create aliases for legitimate or malicious commands, thereby obfuscating their activities and making detection more difficult. The rule includes a filter for common, legitimate CIM session-related aliases to reduce false positives.
Detects when full data export is attempted.
Page 250 of 680