SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,622 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects suspicious access to Domain Group Policies stored in the SYSVOL share. This rule specifically looks for command-line activity that includes both '\SYSVOL\' and '\policies\', indicating an attempt to interact with Group Policy objects.
This rule detects attempts to delete or resize Volume Shadow Copies using various Windows operating system utilities. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially in ransomware attacks. The rule specifically looks for command-line executions of `powershell.exe`, `pwsh.exe`, `wmic.exe`, `vssadmin.exe`, `diskshadow.exe`, and `wbadmin.exe` with arguments indicating shadow copy deletion or resizing operations. This includes commands like 'shadow delete', 'wbadmin delete catalog', and 'vssadmin resize shadowstorage'.
Detects the use of wmic.exe to enumerate service properties (name, displayname, pathname, startmode) which is a common reconnaissance technique used by attackers and pentesters to identify unquoted service paths for potential privilege escalation.
Detects the use of esentutl.exe to interact with Volume Shadow Copy Service (VSS) registry keys. This activity can be indicative of attempts to access or dump credentials, particularly from the Security Account Manager (SAM) database, which is often stored in the registry and can be targeted via VSS snapshots.
Detects modification of the registry key that specifies the path to the screensaver binary. This can be abused by adversaries to establish persistence or elevate privileges by executing malicious code when the screensaver activates.
Detects the modification or creation of registry values related to .NET Framework CLR and .NET Core CLR profiling. Specifically, it looks for 'COR_ENABLE_PROFILING', 'COR_PROFILER', 'CORECLR_ENABLE_PROFILING', and 'CORECLR_PROFILER_PATH' being set. Adversaries can abuse these environment variables to load malicious DLLs into .NET processes for persistence, privilege escalation, or defense evasion.
This rule detects the registration of new ODBC (Open Database Connectivity) drivers by monitoring modifications to specific registry keys. It specifically looks for changes within the `\SOFTWARE\ODBC\ODBCINST.INI\` path where the `TargetObject` ends with `\Driver`. The rule includes filters to exclude common legitimate ODBC driver registrations for SQL Server, Microsoft Access, and Microsoft Excel to reduce false positives.
This rule detects modifications to Microsoft Office registry keys that disable the Protected View feature. Adversaries may disable Protected View to bypass security warnings and execute malicious code embedded in Office documents without user intervention. The rule specifically looks for changes to registry values that control Protected View for attachments, internet files, intranet files, and unsafe locations, setting them to a disabled state (DWORD 0x00000001) or enabling specific protected view settings (DWORD 0x00000000).
Detects modifications to the 'User Shell Folders' registry key, specifically targeting the 'Startup' value. This key can be manipulated by adversaries to achieve persistence by launching malicious payloads during system startup.
This rule detects when the 'DLLPath' registry value for WAB.exe is modified to point to a DLL path different from the default one. WAB.exe is a legitimate Windows binary that can be abused to load arbitrary DLLs, a technique often used for defense evasion and persistence.
Page 547 of 680