SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,525 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.
Detect set Notification_Suppress to 1 to disable the Windows security center notification
Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious commands and strings
Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials
Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.
Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.
PktMon.EXE Execution
Sigma
Detects execution of PktMon, a tool that captures network packets.
Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension
Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence
Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys
Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.
Page 671 of 680