SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,504 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags
Detects the execution of Xwizard tool from a non-default directory.
When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".
When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".
Detects when a memory process image does not match the disk image, indicative of process hollowing.
Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts
Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder
Detects the deletion of registry keys containing the MSTSC connection history
Detects the modification of the PortProxy registry key which is used for port forwarding.
Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
Detects the modification of the registry to allow a driver or service to persist in Safe Mode.
Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information.
Page 149 of 680