SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,502 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of esentutl.exe to interact with Volume Shadow Copy Service (VSS) registry keys. This activity can be indicative of attempts to access or dump credentials, particularly from the Security Account Manager (SAM) database, which is often stored in the registry and can be targeted via VSS snapshots.
Detects modification of the registry key that specifies the path to the screensaver binary. This can be abused by adversaries to establish persistence or elevate privileges by executing malicious code when the screensaver activates.
Detects the modification or creation of registry values related to .NET Framework CLR and .NET Core CLR profiling. Specifically, it looks for 'COR_ENABLE_PROFILING', 'COR_PROFILER', 'CORECLR_ENABLE_PROFILING', and 'CORECLR_PROFILER_PATH' being set. Adversaries can abuse these environment variables to load malicious DLLs into .NET processes for persistence, privilege escalation, or defense evasion.
This rule detects the registration of new ODBC (Open Database Connectivity) drivers by monitoring modifications to specific registry keys. It specifically looks for changes within the `\SOFTWARE\ODBC\ODBCINST.INI\` path where the `TargetObject` ends with `\Driver`. The rule includes filters to exclude common legitimate ODBC driver registrations for SQL Server, Microsoft Access, and Microsoft Excel to reduce false positives.
This rule detects modifications to Microsoft Office registry keys that disable the Protected View feature. Adversaries may disable Protected View to bypass security warnings and execute malicious code embedded in Office documents without user intervention. The rule specifically looks for changes to registry values that control Protected View for attachments, internet files, intranet files, and unsafe locations, setting them to a disabled state (DWORD 0x00000001) or enabling specific protected view settings (DWORD 0x00000000).
Detects modifications to the 'User Shell Folders' registry key, specifically targeting the 'Startup' value. This key can be manipulated by adversaries to achieve persistence by launching malicious payloads during system startup.
This rule detects when the 'DLLPath' registry value for WAB.exe is modified to point to a DLL path different from the default one. WAB.exe is a legitimate Windows binary that can be abused to load arbitrary DLLs, a technique often used for defense evasion and persistence.
Detects modifications to the Windows Package Manager (winget) administrative settings within the registry. This includes changes that could enable local manifest installations or disable installer hash checks, which might be abused by adversaries for defense evasion or persistence.
This rule detects when the Sysmon configuration is changed. This event (EventID 16) is generated by Sysmon itself when its configuration is updated, which could be a legitimate administrative action to reconfigure Sysmon or an attempt by an adversary to manipulate its monitoring capabilities to evade detection.
Detects when a legitimate system process, identified by its executable path starting with 'C:\Windows\', loads a Dynamic Link Library (DLL) from a suspicious or permissively permissioned location such as 'C:\Users\Public\' or 'C:\PerfLogs\'. This behavior can indicate an attempt to bypass User Account Control (UAC), achieve persistence, or execute malicious code through DLL side-loading or hijacking techniques.
Page 545 of 680