SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,512 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the usage of wmic.exe to manipulate Windows registry via the WMI StdRegProv class. This behavior could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe. Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.
Detects the creation of the 'UserInitMprLogonScript' registry value, which can be leveraged by adversaries to establish persistence on a system. This registry key is designed to execute a script upon user logon, making it a valuable target for malicious actors seeking to maintain access.
Detects modifications to specific registry keys under `SYSTEM\CurrentControlSet\Control` that are commonly used for autostart extensibility points (ASEPs). These modifications can indicate persistence mechanisms being established by adversaries.
Detects modifications to various autostart extensibility points (ASEPs) within the Windows Registry's CurrentVersion key. This rule specifically looks for changes to common Run, RunOnce, RunServices, ShellServiceObjectDelayLoad, and other related keys that are frequently abused for persistence and privilege escalation. The rule includes extensive filters for known legitimate software and system processes to reduce false positives.
Detects changes to the default RDP port (3389) in the Windows Registry. Adversaries may modify the RDP port to maintain persistence or evade detection, as this change can allow them to continue using RDP for remote access on a non-standard port.
Detects registry changes to Office trust records where the path is located in a potentially suspicious location, indicating that a macro-enabled document from an unusual or untrusted location has been allowed to run. This could be indicative of an attempt to bypass security controls by executing malicious macros from temporary folders, internet caches, or public user directories.
Detects registry modifications that disable internal tools or functions in explorer, a technique often used by malware like Agent Tesla to hinder user interaction or hide malicious activities.
Detects a suspicious printer driver installation where the 'Manufacturer' registry value is set to an empty string. This behavior can be indicative of malicious activity, potentially related to privilege escalation or defense evasion, as seen in some exploits like PrintNightmare (CVE-2021-1675).
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.
Page 234 of 680