SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects attempts to disable Event Tracing for Windows (ETW) logging within .NET processes by modifying specific registry keys. Adversaries may perform this action to evade detection by security tools that rely on ETW for monitoring .NET activity. The rule specifically looks for modifications to the 'ETWEnabled' and 'ETWFlags' registry keys under 'SOFTWARE\Microsoft\.NETFramework' or 'COMPlus_' prefixed keys, setting their values to '0' (disabled). This indicates an attempt to prevent the recording of loaded .NET assemblies and other relevant ETW events, thereby hindering security monitoring capabilities.
Detects the execution of Windows Credential Editor (WCE), a post-exploitation tool used to extract plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory. This tool is commonly employed by threat actors for credential dumping and facilitating lateral movement within compromised networks.
Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. Adversaries may delete this key to cover their tracks after executing commands, especially in scenarios like clickfix techniques where users are lured into executing malicious commands via the run dialog.
Detects the creation of a specific PowerShell module file ('webAdministration.psm1') within the WindowsPowerShell Modules directory, which is indicative of an attempt to exploit CVE-2022-24527, a local privilege escalation vulnerability in Microsoft Connected Cache. The rule filters out activity by authorized users to reduce false positives.
Detects execution of ChromeLoader malware via a registered scheduled task, specifically looking for PowerShell executing Chrome with a `--load-extension` argument pointing to a suspicious local path.
Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024. Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.
Detects the setting of a new value in the Windows Registry Run key that is used by the Kapeka backdoor for persistence. Specifically, it looks for entries in `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` that end with `\Sens Api` or `\OneDrive` and contain `rundll32.exe`, `.wll`, and `#1` in their details, which are indicators of Kapeka's persistence mechanism.
This rule detects the creation of scheduled tasks using `schtasks.exe` where the parent process originates from a suspicious temporary or user-specific directory. Adversaries often use scheduled tasks for persistence and privilege escalation, and executing the task creation utility from locations like `Temp`, `AppData\Local`, `AppData\Roaming`, `Temporary Internet Files`, or `Users\Public` can indicate malicious activity. Multiple malware strains have been observed employing this technique.
Detects the setting of a registry value within the `\Shell\Open\Command` key using PowerShell classes from the `System.Security.Cryptography` namespace. This technique can be used by adversaries for defense evasion, for example, to decrypt malicious payloads on the fly.
Detects when a user without the necessary permissions attempts to invite a guest user in an Azure environment, indicated by a failed 'Invite external user' operation in the audit logs. This could signify an attempt at unauthorized access, privilege escalation, or persistence.
Page 226 of 680