SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects modifications to common autostart extensibility points (ASEP) in the Windows Registry. These registry keys are frequently used by legitimate software and adversaries to establish persistence by ensuring programs execute automatically upon system boot or user logon. The rule specifically targets a wide range of registry paths associated with autorun functionality, including those for Command Processor, Active Setup, Internet Explorer, and various system services. It includes filters to reduce false positives from known legitimate Microsoft Office, Chrome, Edge, and Internet Explorer activities.
Detects modifications to specific registry keys under the 'Classes' hive that are commonly used as autostart extensibility points (ASEPs). These modifications can be used by adversaries to establish persistence or elevate privileges by ensuring their code executes automatically.
Detects the modification of a registry value related to BgInfo configuration, specifically within the 'UserFields' subkey, where the 'Details' field starts with '4' (indicating a WMI script). This modification can be abused to execute custom VBScript via 'BgInfo.exe', potentially leading to persistence or defense evasion.
Detects modifications to the WinSock2 Parameters registry keys, specifically within Protocol_Catalog9 and NameSpace_Catalog5 entries. These modifications can be used for persistence by adversaries to load malicious code or redirect network traffic.
This rule detects attempts to establish persistence by modifying the "DbgManagedDebugger" registry key within the .NET Framework hive. Adversaries can leverage this mechanism to execute a debugger or any specified executable when a .NET application crashes, effectively achieving persistence or privilege escalation. The rule specifically looks for modifications to the 'Debugger' value under the 'Microsoft\.NETFramework\DbgManagedDebugger' key, while filtering out legitimate modifications made by 'vsjitdebugger.exe'.
Detects when the 'UseActionCenterExperience' registry value is set to 0, which disables Windows Security Center notifications. This can be used by adversaries for defense evasion to prevent users from being alerted to security issues.
Detects changes to the Windows EventLog channel permission values by monitoring modifications to the Security Descriptor Definition Language (SDDL) string in the registry. Such modifications can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify an event log channel. This action can prevent users from accessing the event log channel via Event Viewer or utilities like "Get-EventLog" or "wevtutil".
Detects when the 'DisallowRun' registry value is set to '1' under 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'. This registry setting prevents users from running specified computer programs, which can be used by adversaries for defense evasion or to restrict user capabilities.
This rule detects modifications to the Windows Registry related to Fax Device Providers, specifically looking for changes to the 'ImageName' value within the 'Software\Microsoft\Fax\Device Providers\' path. This technique can be used for persistence by loading a malicious DLL when the Fax service restarts, as highlighted in the provided references.
This rule detects attempts to modify the 'ServiceDll' registry value for the 'wercplsupport' service. This specific modification is associated with the Blue Mockingbird cryptominer, which uses this technique for persistence by hijacking a legitimate service to load its malicious DLL.
Page 245 of 680