SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,600 copies16 likes160,515 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects potential DLL sideloading of "dbghelp.dll" by identifying instances where this DLL is loaded from a non-standard or unexpected directory. This technique can be used by adversaries for defense evasion, persistence, or privilege escalation.
Detects when 'verclsid.exe', a legitimate Windows binary, is used to execute a COM object via its GUID. This technique is often leveraged by adversaries for defense evasion and to bypass application control mechanisms by proxying execution through a trusted system binary.
Detects attempts to tamper with autologger trace sessions by modifying specific registry values. This technique is often used by attackers to disable or impair logging, particularly for Windows Event Log and Windows Defender related logs, to evade detection.
Detects the execution of common reconnaissance commands (ipconfig, net, netstat, ping, systeminfo, tasklist, whoami) where the output is piped to `findstr.exe`. This technique is often used by attackers during the reconnaissance phase to extract specific information.
Detects modifications to the "PendingFileRenameOperations" registry key when initiated by suspicious or uncommon executable locations or by specific system utilities like `reg.exe` or `regedit.exe`. This registry key is used by Windows to stage files for renaming or deletion after a system reboot, and its manipulation can be a defense evasion technique to replace legitimate files with malicious ones or to remove forensic artifacts.
Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
Detects the deletion of a registry key responsible for the 'Scan with Defender' option in the Windows context menu. Attackers may delete this key to hinder users from easily scanning suspicious files, thereby weakening defenses.
Page 270 of 680