SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,512 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects the creation of an ActiveScriptEventConsumer via the `wmic.exe` command-line utility. Adversaries often use WMI event subscriptions to establish persistence or elevate privileges by executing malicious code when a specific event occurs. The presence of 'ActiveScriptEventConsumer' and 'CREATE' in the command line indicates an attempt to set up such a subscription.
Detects potential COM object hijacking attempts by monitoring the creation of 'TreatAs' subkeys within the HKU (HKEY_USERS) hive. Adversaries can manipulate the Windows Component Object Model (COM) registry structure to redirect legitimate COM object calls to malicious code, achieving persistence or privilege escalation. This rule specifically looks for the creation of a 'TreatAs' subkey under a CLSID (Class ID) entry, which is a known method for COM hijacking. The rule filters out creations by 'svchost.exe' to reduce false positives, as svchost can legitimately create such keys.
Detects the presence of a registry key created during Azorult malware execution. Specifically, it looks for modifications to registry keys ending with '\services\localNETService' within the 'SYSTEM\' hive, which is a known indicator for Azorult.
This rule detects attempts to establish persistence or escalate privileges by abusing the Windows 10 Narrator's Feedback-Hub. Specifically, it looks for the deletion of the 'DelegateExecute' value or modification of the '(Default)' value within a specific registry key associated with the Feedback-Hub application. This technique can be used by an attacker to inject a malicious payload that will execute when the Narrator's Feedback-Hub is launched.
Detects potential malicious modification of the 'Run' registry key by malware identified as 'winekey' or 'team9' (Bazar/KEGTAP) to establish persistence. Specifically, it looks for modifications to the 'Software\Microsoft\Windows\CurrentVersion\Run\Backup Mgr' registry value.
Detects modifications to the 'HKLM\SOFTWARE\Microsoft\HTMLHelp\data' registry key, which is associated with the RedMimicry Winnti playbook. This registry key can be used for persistence or defense evasion by adversaries.
Detects attempts to establish persistence by modifying registry keys associated with the Recycle Bin. This technique leverages the Recycle Bin's CLSID to execute arbitrary commands, often for privilege escalation or maintaining access.
Detects modifications to Internet Explorer's autostart extensibility points (ASEPs) in the Windows Registry. Adversaries may modify these registry keys to establish persistence or elevate privileges by ensuring malicious code executes when Internet Explorer starts or when a user logs in.
Detects when the 'fAllowToGetHelp' registry value is set to 1, which enables the Remote Assistance feature on a Windows machine. This allows a specific user to establish an RDP connection for remote assistance.
Detects modifications to autostart extensibility points (ASEP) within the Windows Registry, specifically focusing on keys under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion' that are commonly used for persistence. This includes modifications to Winlogon, Windows, Image File Execution Options, Font Drivers, and Drivers32 subkeys. The rule includes filters for known legitimate activities by Microsoft Edge, Microsoft Office, OneDrive, Avira, and .NET Framework's NGEN.
Page 239 of 680