SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,513 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
This rule detects potential persistence via Component Object Model (COM) hijacking by monitoring modifications to the Windows Registry. Specifically, it looks for changes where the 'InprocServer32\(Default)' key is set to 'C:\WINDOWS\system32\scrobj.dll'. Adversaries can abuse scrobj.dll, which looks for the 'ScriptletURL' key to execute scripts, to maintain persistence on a system.
Detects changes to the "ExtErrorInformation" key in the Windows Registry to disable Event Tracing for Windows (ETW) logging specifically for rpcrt4.dll. This modification can be used by adversaries to impair defenses by hiding their activities related to RPC (Remote Procedure Call) communications.
Detects when the 'Notification_Suppress' registry value is set to 1 under 'SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration'. This action disables Windows Security Center notifications, which can be used by adversaries for defense evasion to prevent users from being alerted to security issues.
Detects modifications to the 'TreatAs' registry key, which can be used for COM Hijacking. This technique allows an attacker to substitute a legitimate COM object with a malicious one, often used for persistence or privilege escalation, particularly when combined with commands like "rundll32.exe -sta". The rule includes filters for common legitimate processes that might modify this key, such as Microsoft Office components, svchost.exe, and msiexec.exe during installations or updates.
This rule detects the use of 'Set-Alias' or 'New-Alias' cmdlets in PowerShell script block logs. Adversaries often use these cmdlets to create aliases for legitimate or malicious commands, thereby obfuscating their activities and making detection more difficult. The rule includes a filter for common, legitimate CIM session-related aliases to reduce false positives.
Detects when full data export is attempted.
Detects when full data export is attempted an unauthorized user.
Detects user data export activity.
Detects SSH user login access failures.
Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.
Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.
Detects user permission data export attempt.
Page 249 of 680