SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,479 copies16 likes159,608 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when an attacker adds a new "Debugger" value to the "Hangs" key in the Windows Error Reporting (WER) registry path. This technique can be used to achieve persistence by registering a malicious debugger that will be invoked when an application crashes, allowing the attacker to execute arbitrary code.
This rule detects modifications to the Windows Registry that are used to hide file extensions or make files hidden. Specifically, it looks for changes to the 'HideFileExt' and 'Hidden' DWORD values within the 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' registry key. Setting 'HideFileExt' to '0x00000001' hides known file extensions, and setting 'Hidden' to '0x00000002' shows hidden files, which could be used by an attacker to manipulate visibility of malicious files.
Detects when an attacker modifies the registry value associated with the 'hhctrl.ocx' COM object to point to a custom binary. This technique can be used for persistence, as 'hhctrl.ocx' is a legitimate Microsoft HTML Help ActiveX control, and hijacking its registration can lead to arbitrary code execution.
Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.
This rule detects attempts to establish persistence by modifying the 'HtmlHelp Author' registry key. Attackers can leverage this mechanism to execute malicious code when HTML Help files are accessed, as the 'Location' value under 'Software\Microsoft\HtmlHelp Author' or 'Software\WOW6432Node\Microsoft\HtmlHelp Author' can be manipulated to point to a malicious DLL.
Detects registry persistence techniques leveraging the GlobalFlags and SilentProcessExit keys within the Image File Execution Options (IFEO) registry path. Adversaries can modify these registry keys to execute arbitrary code when a specific application starts or exits, providing a stealthy method for persistence and privilege escalation.
Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass. The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.
This rule detects modifications or additions to the 'TypedPaths' registry key, which is used by Windows Explorer to store recently typed paths in the Run dialog and File Explorer address bar. Adversaries can leverage this key for persistence by injecting malicious paths that get executed when a user interacts with these features. The rule specifically filters out modifications made by the legitimate 'explorer.exe' process to reduce false positives, focusing on non-standard applications attempting to modify this key.
Detects when PowerShell code is written to the Windows Registry as part of a service's ImagePath. This technique can be used by adversaries to establish persistence and execute malicious PowerShell scripts when the service starts.
Detects the creation or modification of a registry key related to screen savers, specifically when `rundll32.exe` is used to set a screen saver executable (`SCRNSAVE.EXE`) to a `.scr` file, while excluding common legitimate system paths. This technique can be used by adversaries to establish persistence or execute malicious code through masqueraded screen saver files.
Page 573 of 680