SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the modification of a registry value under `\Software\Winternals\BGInfo\UserFields\` where the `Details` field starts with '6', indicating a custom WMI query. This activity can be abused by adversaries to execute arbitrary WMI queries via BgInfo.exe, potentially leading to persistence or defense evasion.
Detects the modification or creation of the 'Database' registry value under 'Software\Winternals\BGInfo' which can be used by attackers to specify an external database path for BgInfo. This could be leveraged to exfiltrate information collected by BgInfo by directing it to a controlled location.
This rule detects modifications to specific autostart extensibility points (ASEPs) within the `Wow6432Node` path of the Windows registry. These registry keys are commonly used by legitimate applications for persistence, but also by adversaries to establish persistence or elevate privileges by ensuring their malicious code executes upon user login or system startup. The rule specifically targets modifications under `HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion` for keys like `Run`, `RunOnce`, `ShellServiceObjectDelayLoad`, and various `Explorer` related autostart locations.
This rule detects modifications to the Windows Registry keys responsible for DHCP server Callout DLLs. Attackers can leverage this mechanism to install malicious DLLs that execute in the context of the DHCP server, leading to privilege escalation, persistence, and defense evasion. The rule specifically looks for changes to the 'CalloutDlls' and 'CalloutEnabled' values under the 'HKLM\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters' path.
This rule detects modifications to the "DsrmAdminLogonBehavior" registry value. Attackers may modify this value to abuse the Directory Services Restore Mode (DSRM) administrator account for persistence and access to Active Directory. The DSRM account is a local administrator account on a Domain Controller, typically used for restoring AD backups or recovering from failures. By changing "DsrmAdminLogonBehavior" from its default value of '0' (only usable in DSRM) to '1' (usable when AD DS service is stopped) or '2' (always usable), attackers can gain persistent access to the Domain Controller outside of DSRM, facilitating credential access and defense evasion.
Detects registry modifications that hide internal tools or functions from the user, a technique often employed by malware such as Agent Tesla and Hermetic Wiper. The rule specifically looks for changes to registry keys related to hiding clock, health, network, power, and volume icons in the system tray, as well as disabling advanced explorer features like showing info tips or compressed file colors.
Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper.
Detects a registry modification that disables security warnings for Microsoft Office macros, specifically setting the 'VBAWarnings' registry value to '1'. This configuration allows the execution of all macros, whether signed or unsigned, which can be abused by attackers for initial access, persistence, or defense evasion.
Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism.
Detects potential persistence activity by monitoring the registration of new custom protocol handlers in the Windows Registry. Attackers can abuse this mechanism to establish persistence by setting a custom handler to execute malicious code when a specific URI scheme is accessed. The rule filters out common legitimate Microsoft protocols and applications installed in standard program file locations to reduce false positives.
Page 240 of 680