SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects attempts to modify Remote Desktop Protocol (RDP) related registry keys using the `reg.exe` utility. Specifically, it looks for command-line executions of `reg.exe` that add or modify values within the `CurrentControlSet\Control\Terminal Server` registry path. The rule targets modifications related to RDP licensing, concurrent sessions, WinStation configurations (like `MaxInstanceCount`, `fEnableWinStation`, `TSUserEnabled`, `TSEnabled`, `TSAppCompat`, `IdleWinStationPoolCount`, `TSAdvertise`, `AllowTSConnections`, `fSingleSessionPerUser`, `fDenyTSConnections`), which could indicate an adversary enabling or reconfiguring RDP for persistence, lateral movement, or defense evasion.
Detects when 'regedit.exe' is launched with elevated privileges by either 'TrustedInstaller.exe' or 'ProcessHacker.exe'. This activity is highly suspicious as it indicates an attempt to modify the registry with system-level permissions, potentially for defense evasion or privilege escalation.
Detects the use of 'regedit.exe' to import a registry file that originates from an Alternate Data Stream (ADS). This technique can be used by adversaries for persistence, defense evasion, or to modify system configurations by importing registry keys from hidden data streams.
Detects attempts to modify critical service configuration registry keys (ImagePath, FailureCommand, and ServiceDll) by processes running with a 'Medium' integrity level. This activity can indicate a privilege escalation attempt where an attacker with medium integrity tries to alter service execution to gain higher privileges or establish persistence.
Detects the execution of 'regini.exe', a legitimate Windows utility that can be used to modify registry keys by importing changes from one or more text files. This activity can be indicative of an adversary attempting to alter system configurations, achieve persistence, or evade defenses by manipulating the Windows Registry.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. This specific command line indicates that TeamViewer_Desktop.exe is being launched by TeamViewer_Service.exe with an IPC port of 5939 and module 1, which is characteristic of a remote connection being established. An investigator can verify connection details by reviewing the "incoming_connections.txt" log file in the TeamViewer folder.
This rule detects when 'sdclt.exe' (System Data Collector) spawns any child processes. This behavior is often associated with User Account Control (UAC) bypass techniques, where sdclt.exe is leveraged to execute arbitrary code with elevated privileges without triggering a UAC prompt. The rule is a general indicator of such activity.
This rule detects attempts to write or modify files within the `C:\Windows\System32\Tasks\` or `C:\Windows\SysWow64\Tasks\` directories using common command-line utilities. Adversaries may leverage the globally writable nature of these folders to achieve privilege escalation, persistence, or defense evasion by loading custom assemblies or scripts into legitimate Windows processes like cscript, wscript, regsvr32, mshta, or eventvwr.
Detects the execution of Sysinternals PsSuspend, a utility that can be used to suspend running processes. This tool can be abused by adversaries to halt critical security processes or other applications, potentially for evasion or to facilitate further malicious activity.
Detects the creation of a process where the parent process is 'EdgeTransport.exe' and the child process is not 'conhost.exe' or 'OleConverter.exe'. This behavior is indicative of a WMI backdoor being used in Exchange Transport Agents, leveraging WMI event filters for persistence or execution.
Page 238 of 680