SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,619 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of WMIC with the "csproduct" argument, which is used by adversaries to obtain information such as hardware models and vendor details from a system. This can be part of reconnaissance activities.
Detects the execution of "wmic.exe" with the "process" flag, which adversaries might use to list processes running on the compromised host or list installed software hotfixes and patches. This rule specifically excludes commands that involve creating processes, focusing on reconnaissance activities.
Detects the execution of WMIC to query information on a remote system, specifically looking for the '/node:' command-line argument to identify remote interactions, while filtering out local connections to 127.0.0.1 or localhost.
This rule detects the deletion of the 'SD' (Security Descriptor) value within the `\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\` registry hive. This action is typically performed by adversaries to hide scheduled tasks, making them less visible to standard enumeration tools. This technique has been observed in use by the Tarrask malware.
Detects the addition of the 'Office test' registry key, specifically the 'Special\Perf' subkey, which allows an arbitrary DLL to be executed every time an Office application is started. This method is used for persistence.
Detects modifications to Windows Defender exclusion registry keys, which adversaries may use to disable or bypass antivirus scanning for specific files or paths.
Detects tampering with the 'File' key within the Windows EventLog service registry path. This modification can be used by adversaries to change the default location of an EVTX log file, thereby hindering log collection and alerting mechanisms. The rule specifically looks for changes to the 'File' value in any EventLog service subkey, excluding changes that merely point to the default 'System32\Winevt\Logs\' directory.
Detects when the "Index" value of a scheduled task is modified in the registry to "DWORD (0x00000000)". This modification effectively hides the scheduled task from standard tooling like "schtasks /query", making it harder for defenders to discover.
Detects modifications to the 'LegalNoticeCaption' or 'LegalNoticeText' registry values that include keywords commonly found in ransomware ransom messages. This activity is often associated with ransomware operations attempting to display a ransom note to users upon login.
This rule detects the creation of new entries in the AppCompatFlags\Compatibility Assistant\Store registry key. This key is used by Windows to track applications that have been executed for the first time on an endpoint. This detection can indicate the introduction and initial execution of new software, which could be legitimate or malicious.
Page 557 of 680