SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,612 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of 'wmic.exe' with the 'qfe' flag to enumerate installed hotfix updates on a Windows system. This activity is commonly observed in penetration testing and attacker reconnaissance scripts to gather system information.
This rule detects the execution of 'wmic.exe' with command-line arguments indicating a query for service information. Adversaries may use WMIC to perform reconnaissance on remote systems, checking for the existence and status of specific services. The rule specifically looks for 'wmic.exe' or 'WMIC.exe' in the image name or original file name, combined with the presence of 'service' in the command line.
Detects when the WmiPrvSE.exe process spawns a new process. This activity can be indicative of malicious use of Windows Management Instrumentation (WMI) for execution, as WmiPrvSE.exe is a legitimate process that hosts WMI provider plug-ins. Adversaries often abuse WMI to execute commands or maintain persistence.
Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cleanup manager is part of the operating system and allows users to enable or disable individual handlers. It is extensible, allowing developers to implement and register their own disk cleanup handlers. This rule specifically looks for the creation of new registry keys under 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\' which could indicate a malicious handler being registered for persistence, while filtering out known legitimate default entries.
Detects the removal of folders from the "ProtectedFolders" list within Windows Defender Exploit Guard's Controlled Folder Access feature. This action could indicate an attacker attempting to bypass security controls to launch an encryption process, manipulate data within a protected folder, or otherwise impair defenses.
Detects when the "Index" value of a scheduled task is removed or deleted from the Windows Registry. This action effectively hides the scheduled task from standard tooling like "schtasks /query", making it a defense evasion technique.
This rule detects an unfixed User Account Control (UAC) bypass method in Windows 10 that leverages WSReset.exe. The bypass works by modifying a specific registry key associated with the Windows Store, allowing a low-privilege binary to be executed with elevated privileges when WSReset.exe is run.
This rule detects attempts to disable the automatic creation of administrative shares (C$, ADMIN$) at system startup by modifying specific registry values. Adversaries might do this as a defense evasion technique to remove traces of their activity or to hinder forensic analysis, as administrative shares are often used for legitimate remote administration and can also be leveraged by attackers for lateral movement.
Detects attempts to disable the runtime scanning of enabled macros in Microsoft Office by modifying the 'MacroRuntimeScanScope' registry key. This modification can be used by adversaries to bypass security features like AMSI (Antimalware Scan Interface) for VBA macros, allowing malicious macros to execute undetected.
Detects when Windows Defender Exploit Guard Network Protection is disabled by a registry modification. This action can be taken by an adversary to bypass security controls and facilitate malicious network activity.
Page 572 of 680