SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,474 copies16 likes159,599 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects modifications to the Windows Registry that disable the Privacy Settings Experience. This can be an attempt by an adversary to impair defenses or hide their activities by preventing privacy-related notifications or settings from appearing.
This rule detects attempts to disable Windows Defender's Potentially Unwanted Application (PUA) protection by monitoring changes to the 'PUAProtection' registry key. Specifically, it triggers when the 'PUAProtection' value is set to '0x00000000' (DWORD 0), indicating that PUA protection has been disabled.
Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun. The rule specifically looks for modifications to the 'Autorun', 'CleanupString', or 'PreCleanupString' registry values within the 'VolumeCaches' key, combined with specific executable names or common suspicious paths in the 'Details' field.
Detects the modification of the 'TurnOffCheck' registry value to '1' (0x00000001) within the 'ScriptedDiagnostics' key. This action can be used to bypass defenses related to the Microsoft Support Diagnostic Tool (MSDT) Follina vulnerability, as setting this value to 1 disables checks for scripted diagnostics. An attacker might enable this to execute malicious code via MSDT without user interaction or security warnings.
Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json
This rule detects attempts to establish persistence by modifying specific registry keys related to the Windows Event Viewer's redirection functionality. Adversaries can manipulate these keys, specifically 'MicrosoftRedirectionProgram' and 'MicrosoftRedirectionURL', to execute arbitrary programs or open malicious URLs when a user interacts with the Event Viewer. The rule filters out legitimate modifications made by svchost.exe (likely via GPO) for default redirection programs and command-line parameters, as well as the default Microsoft events.asp URL and empty values, to reduce false positives.
This rule detects attempts to tamper with Windows Attachment Manager settings by modifying specific registry keys. Adversaries might do this to lower the default file type risk, allowing potentially malicious files (like executables, scripts, or archives) to bypass security warnings when downloaded or opened. The rule specifically looks for modifications to 'DefaultFileTypeRisk' to a value that indicates low risk (0x00006152) or additions of common executable/script file extensions to 'LowRiskFileTypes'.
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe". This technique is often used to bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.
Detects the creation or modification of user-specific or system-wide environment variables in the Windows Registry that contain suspicious commands, strings, or encoded payloads. This rule looks for common indicators of malicious activity such as PowerShell commands, temporary file paths, and various Base64 encoded strings often associated with malware or attacker tools.
This rule detects when an application or user re-enables older, less secure TLS versions (TLS 1.0 or TLS 1.1) by setting the 'Enabled' registry value to '1' under the 'Protocols' key in the Windows registry. This action can weaken the system's security posture by allowing communication over deprecated protocols.
Page 588 of 680