SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,526 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects registry modifications that disable Privacy Settings Experience
Detect set EnableFirewall to 0 to disable the Windows firewall
Detect set DisallowRun to 1 to prevent user running specific computer program
Hides the file extension through modification of the registry
Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)
Detects the addition of new root, CA or AuthRoot certificates to the Windows registry
Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages
Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.
Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32" library
Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute
Page 670 of 680