SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,565 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects attempts to disable the Windows Firewall using PowerShell
Detects specific combinations of encoding methods in PowerShell via the commandline
Detects presence of a potentially xor encoded powershell command
Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility
Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection
Detects the import of the specified file to the registry with regedit.exe.
Detects the import of a alternate datastream to the registry with regedit.exe.
Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.
Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Page 68 of 680