SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,587 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when the 'windir' environment variable is modified from its default value. This modification is often a precursor to a User Account Control (UAC) bypass technique leveraging the 'SilentCleanup' scheduled task, which is an auto-elevated task that can execute with administrator privileges without prompting the user.
This rule detects modifications to the Internet Explorer ZoneMap Domains registry key, which can be used to add domains to specific security zones (e.g., Trusted Sites). Adversaries might modify these settings to lower security restrictions for malicious websites or to bypass security prompts.
Detects when the Windows Firewall is disabled by setting the 'EnableFirewall' registry value to 0 (DWORD 0x00000000) for either the StandardProfile or DomainProfile. This action can be performed by adversaries to bypass network controls and facilitate malicious activity.
Detects applications being added to the "allowed applications" list of Exploit Guard's Controlled Folder Access feature, specifically when these applications are located in suspicious paths. This action can be used by adversaries to bypass Controlled Folder Access protections and execute malicious code.
Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in the Windows Registry to achieve persistence. This persistence mechanism leverages the "SearchIndexer.exe" process to invoke the malicious DLL.
Detects the installation of 'NalDrv' or 'PROCEXP152' services by monitoring registry key modifications. These services are associated with the 'Ghost-In-The-Logs' tool, which leverages KDU for defense evasion. The rule specifically looks for the creation of these service ImagePath registry values in non-system32 folders, filtering out legitimate instances of tools like procexp and procmon.
Detects a specific UAC bypass technique (UACMe 52) that abuses a path parsing vulnerability in `winsat.exe`. This bypass involves modifying registry keys related to `winsat.exe` to point to a malicious executable located in a temporary directory, allowing for privilege escalation without a UAC prompt.
Detects when an attacker registers a new AMSI provider in the Windows Registry to establish persistence. This technique involves creating or modifying registry keys under `SOFTWARE\Microsoft\AMSI\Providers\` or `SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\` to load a malicious DLL when AMSI is initialized. The rule filters out legitimate system processes that might perform similar actions from standard Windows and Program Files directories.
This rule detects attempts to tamper with Windows Attachment Manager settings by modifying specific registry values. These modifications can disable security features related to file attachments, such as hiding zone information, preventing the saving of zone information, or disabling antivirus scanning for downloaded files. Such actions are often performed by adversaries to evade detection and facilitate the execution of malicious files.
Detects potentially suspicious child processes of WinRAR.exe.
Page 595 of 680