SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,496 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when the "Index" value of a scheduled task is removed or deleted from the Windows Registry. This action effectively hides the scheduled task from standard tooling like "schtasks /query", making it a defense evasion technique.
This rule detects an unfixed User Account Control (UAC) bypass method in Windows 10 that leverages WSReset.exe. The bypass works by modifying a specific registry key associated with the Windows Store, allowing a low-privilege binary to be executed with elevated privileges when WSReset.exe is run.
This rule detects attempts to hijack the Antimalware Scan Interface (AMSI) COM server by modifying a specific registry key. Adversaries can change the default value of the `InProcServer32` key for the AMSI CLSID (`{fdb00e52-a214-4aa1-8fba-4357bb0072ec}`) to point to a non-existent COM server. This action prevents AMSI from loading its COM component, effectively disabling its scanning functionalities and rendering it useless for malware detection.
This rule detects attempts to disable the automatic creation of administrative shares (C$, ADMIN$) at system startup by modifying specific registry values. Adversaries might do this as a defense evasion technique to remove traces of their activity or to hinder forensic analysis, as administrative shares are often used for legitimate remote administration and can also be leveraged by attackers for lateral movement.
Detects attempts to disable the runtime scanning of enabled macros in Microsoft Office by modifying the 'MacroRuntimeScanScope' registry key. This modification can be used by adversaries to bypass security features like AMSI (Antimalware Scan Interface) for VBA macros, allowing malicious macros to execute undetected.
Detects when Windows Defender Exploit Guard Network Protection is disabled by a registry modification. This action can be taken by an adversary to bypass security controls and facilitate malicious network activity.
Detects when an attacker adds a new "Debugger" value to the "Hangs" key in the Windows Error Reporting (WER) registry path. This technique can be used to achieve persistence by registering a malicious debugger that will be invoked when an application crashes, allowing the attacker to execute arbitrary code.
Detects when an attacker modifies the registry value associated with the 'hhctrl.ocx' COM object to point to a custom binary. This technique can be used for persistence, as 'hhctrl.ocx' is a legitimate Microsoft HTML Help ActiveX control, and hijacking its registration can lead to arbitrary code execution.
Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.
This rule detects attempts to establish persistence by modifying the 'HtmlHelp Author' registry key. Attackers can leverage this mechanism to execute malicious code when HTML Help files are accessed, as the 'Location' value under 'Software\Microsoft\HtmlHelp Author' or 'Software\WOW6432Node\Microsoft\HtmlHelp Author' can be manipulated to point to a malicious DLL.
Page 570 of 680