SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,502 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when the "Index" value of a scheduled task is modified in the registry to "DWORD (0x00000000)". This modification effectively hides the scheduled task from standard tooling like "schtasks /query", making it harder for defenders to discover.
Detects modifications to the 'LegalNoticeCaption' or 'LegalNoticeText' registry values that include keywords commonly found in ransomware ransom messages. This activity is often associated with ransomware operations attempting to display a ransom note to users upon login.
This rule detects the creation of new entries in the AppCompatFlags\Compatibility Assistant\Store registry key. This key is used by Windows to track applications that have been executed for the first time on an endpoint. This detection can indicate the introduction and initial execution of new software, which could be legitimate or malicious.
Detects when a non-Sysinternals tool attempts to set the 'EulaAccepted' registry key for a Sysinternals tool. This behavior is indicative of an adversary attempting to use renamed Sysinternals tools to evade detection, as the 'EulaAccepted' key is typically set by the legitimate Sysinternals tool upon its first execution.
Detects a User Account Control (UAC) bypass technique that exploits the 'iscsicpl.exe' process. This bypass leverages DLL Search Order Hijacking to load a malicious 'iscsiexe.dll' from a user-controlled location (e.g., temporary directory or a modified PATH environment variable) instead of the legitimate system directory. The rule specifically looks for 'iscsicpl.exe' loading 'iscsiexe.dll' from any location other than 'C:\Windows\'.
This rule detects instances where 'rundll32.exe' initiates an outbound network connection to a public IP address. It filters out connections to common local, private, and Microsoft-owned IP ranges, as well as specific legitimate command lines and Azure internal hostnames, to reduce false positives. The rule aims to identify suspicious network activity originating from rundll32.exe, which is often abused by malware for defense evasion and execution.
Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and make network connections. This rule specifically looks for wuauclt.exe making network connections with the '/RunHandlerComServer' command-line argument, while filtering out common internal IP ranges and known Microsoft update server IP ranges to reduce false positives. It also filters out specific command-line patterns related to legitimate Windows Update deployments.
Detects the creation of a named pipe with a name starting with '\PAExec', which is the default named pipe used by the PAExec utility. This can indicate remote execution activity using PAExec.
This rule detects the execution of the PowerShell cmdlet 'Get-NetTCPConnection', which adversaries may use to discover network connections on a compromised system. This activity is often part of the discovery phase in an attack chain, where an attacker gathers information about the network environment.
This rule detects the use of the 'Expand-Archive' command within PowerShell logs. Adversaries may use this command to decompress files, potentially as part of a larger attack chain involving unpacking malicious payloads or tools.
Page 555 of 680