SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,497 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the execution of the Radmin Viewer utility, which is a legitimate remote administration tool that can be leveraged by adversaries for remote control and lateral movement within a Windows environment.
Detects the execution of the reconnaissance tool Seatbelt. This rule identifies Seatbelt activity based on its executable name, original file name, description, and specific command-line arguments used for various discovery tasks, including DpapiMasterKeys, InterestingProcesses, InterestingFiles, CertificateThumbprints, Chromium data, CloudCredentials, CredEnum, CredGuard, FirefoxHistory, and ProcessCreationEvents. It also covers group-based commands like 'misc', 'remote', 'chromium', 'slack', 'system', 'user', and 'all', as well as output to a file.
Detects the execution of Python with command-line arguments that indicate an attempt to spawn a pseudo-terminal (TTY). This technique is often used by attackers to gain an interactive shell, especially in compromised environments where direct shell access might be restricted. The rule specifically looks for Python executable names combined with command-line patterns like 'import pty', '.spawn(', or 'from pty import spawn'.
Detects the execution of the 'reg.exe' utility with the 'delete' flag targeting registry keys associated with Windows services. This activity is often performed by attackers to remove or disable security software services as a defense evasion tactic.
Detects the execution of 'reg.exe' to modify registry keys associated with various Windows security services, attempting to disable them. This includes services like Windows Defender components (MsMpSvc, WinDefend, WdBoot, WdFilter, WdNisDrv, WdNisSvc), SecurityHealthService, AppIDSvc, NisSrv, Sense, UsoSvc, wscsvc, and wuauserv, by setting their 'Start' value to '4' (disabled).
This rule detects suspicious modifications to the Windows Registry related to the 'ms-settings' URI scheme, specifically targeting the 'DelegateExecute' value or the default value of 'HKCU\Software\Classes\ms-settings\Shell\Open\Command'. This technique can be used by adversaries to hijack the execution of applications launched via the 'ms-settings' URI, potentially leading to arbitrary code execution or privilege escalation. The rule also includes a detection for the deletion of the 'ms-settings' key, which could be an attempt to clean up after such an attack.
This rule detects attempts to enumerate installed software versions on a Windows system using the `reg.exe` utility. Specifically, it looks for `reg.exe` commands that query the registry for software version information, often found under `HKEY_LOCAL_MACHINE\Software\` paths and requesting the `svcVersion` value. This activity can be indicative of an adversary trying to identify vulnerable software or understand the system's security posture.
Detects commands that attempt to disable Volume Shadow Copy Service (VSS) diagnostic logging by setting the 'Disabled' flag. This activity is often associated with ransomware or other malware attempting to prevent recovery of encrypted files or to evade forensic analysis.
Detects applications attempting to modify the Windows Registry to disable write protection for storage devices. This activity can precede ransomware attacks or other malicious data manipulation, as observed with certain threat groups.
Detects `regsvr32.exe` execution attempting to download and install DLLs from a remote IP address. This technique is often used for defense evasion and bypassing application control by leveraging a trusted Microsoft binary to execute arbitrary code.
Page 566 of 680