SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,473 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker.
Define a baseline threshold for failed sign-ins due to Conditional Access failures
Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.
Detects modification of the Microsoft Security Center AV registry keys, particularly those related with DisplayName, ProductEXE, or ReportingExe.
These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software.
But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.
These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software.
But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.
Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc
Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.
Detects an uncommon svchost parent process
Detects the creation of new files with the ".evtx" extension in non-common or non-standard location.
This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within.
Note that backup software and legitimate administrator might perform similar actions during troubleshooting.
This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within.
Note that backup software and legitimate administrator might perform similar actions during troubleshooting.
Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being
set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft
Defender Firewall and can restore network paths that a hardened profile would block.
set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft
Defender Firewall and can restore network paths that a hardened profile would block.
Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)
Page 11 of 680