SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,501 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects attempts to add an insecure (HTTP) download source to Winget. While Winget is designed to prevent the addition of insecure sources, this activity could indicate an attempt to bypass security controls or a user error. This rule specifically looks for the execution of 'winget.exe' with 'source add' and 'http://' in the command line.
Detects suspicious child processes spawned by Windows Terminal (WindowsTerminal.exe or wt.exe). This rule identifies the execution of common Living Off The Land Binaries (LOLBins) like rundll32.exe, regsvr32.exe, certutil.exe, cscript.exe, wscript.exe, and csc.exe, as well as processes launched from suspicious user-controlled directories (e.g., Downloads, Desktop, Temp folders). Additionally, it flags command lines containing keywords often associated with malicious activity, such as PowerShell Invoke- and DownloadString, or common command shell execution parameters. This activity could indicate an adversary establishing persistence or executing malicious code via Windows Terminal.
Detects the execution of WinRAR to compress files with '.dmp', '.dump', or '.hdmp' extensions. This activity could indicate a step in exfiltrating memory dump files or other sensitive dump files.
Detects the execution of WMIC with the "csproduct" argument, which is used by adversaries to obtain information such as hardware models and vendor details from a system. This can be part of reconnaissance activities.
Detects the execution of WMIC to query information on a remote system, specifically looking for the '/node:' command-line argument to identify remote interactions, while filtering out local connections to 127.0.0.1 or localhost.
Detects when the WmiPrvSE.exe process spawns a new process. This activity can be indicative of malicious use of Windows Management Instrumentation (WMI) for execution, as WmiPrvSE.exe is a legitimate process that hosts WMI provider plug-ins. Adversaries often abuse WMI to execute commands or maintain persistence.
Detects the addition of the 'Office test' registry key, specifically the 'Special\Perf' subkey, which allows an arbitrary DLL to be executed every time an Office application is started. This method is used for persistence.
Detects modifications to Windows Defender exclusion registry keys, which adversaries may use to disable or bypass antivirus scanning for specific files or paths.
Detects tampering with the 'File' key within the Windows EventLog service registry path. This modification can be used by adversaries to change the default location of an EVTX log file, thereby hindering log collection and alerting mechanisms. The rule specifically looks for changes to the 'File' value in any EventLog service subkey, excluding changes that merely point to the default 'System32\Winevt\Logs\' directory.
This rule detects modifications to the Windows Registry that are used to hide file extensions or make files hidden. Specifically, it looks for changes to the 'HideFileExt' and 'Hidden' DWORD values within the 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' registry key. Setting 'HideFileExt' to '0x00000001' hides known file extensions, and setting 'Hidden' to '0x00000002' shows hidden files, which could be used by an attacker to manipulate visibility of malicious files.
Page 554 of 680