SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,496 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects registry persistence techniques leveraging the GlobalFlags and SilentProcessExit keys within the Image File Execution Options (IFEO) registry path. Adversaries can modify these registry keys to execute arbitrary code when a specific application starts or exits, providing a stealthy method for persistence and privilege escalation.
Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass. The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.
This rule detects modifications or additions to the 'TypedPaths' registry key, which is used by Windows Explorer to store recently typed paths in the Run dialog and File Explorer address bar. Adversaries can leverage this key for persistence by injecting malicious paths that get executed when a user interacts with these features. The rule specifically filters out modifications made by the legitimate 'explorer.exe' process to reduce false positives, focusing on non-standard applications attempting to modify this key.
Detects when PowerShell code is written to the Windows Registry as part of a service's ImagePath. This technique can be used by adversaries to establish persistence and execute malicious PowerShell scripts when the service starts.
Detects the creation or modification of a registry key related to screen savers, specifically when `rundll32.exe` is used to set a screen saver executable (`SCRNSAVE.EXE`) to a `.scr` file, while excluding common legitimate system paths. This technique can be used by adversaries to establish persistence or execute malicious code through masqueraded screen saver files.
This rule detects attempts to establish persistence and evade defenses by registering a new Subject Interface Package (SIP) provider. Attackers can modify specific registry keys related to cryptographic providers to redirect signature validation functions to malicious DLLs. This allows them to bypass application control mechanisms by making the system trust unsigned or malicious code as legitimately signed. The rule specifically looks for modifications to registry paths associated with Microsoft Cryptography Providers and OID EncodingType, where the 'Dll' or '$DLL' values are being set, while filtering out known legitimate SIP registrations by the OS or specific software like WINTRUST.DLL and mso.dll. It also filters out specific legitimate activity related to poqexec.exe and PsfSip.dll.
Detects attempts to tamper with Sophos antivirus functionality by modifying specific registry keys related to Tamper Protection. This rule looks for changes to 'SAVEnabled', 'SEDEnabled', or 'Enabled' keys within Sophos Endpoint Defense or SAVService paths, specifically when the value is set to '0x00000000' (disabled).
This rule detects User Account Control (UAC) bypass attempts by monitoring specific registry key modifications related to `sdclt.exe`. Attackers can manipulate these registry keys to hijack the execution flow of `sdclt.exe`, a legitimate Windows utility, to run arbitrary code with elevated privileges without triggering a UAC prompt. The rule specifically looks for modifications to `Software\Classes\exefile\shell\runas\command\isolatedCommand` or `Software\Classes\Folder\shell\open\command\SymbolicLinkValue` with a specific pattern indicating a UAC bypass technique.
This rule detects when the 'EnableLocalManifestFiles' setting for AppInstaller (winget) is activated in the Windows Registry. Enabling this setting allows users to install new packages using custom manifests, which could be abused by adversaries to install malicious software or achieve persistence.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario. This specific rule focuses on `wmiprvse.exe` loading the hijacked `wbemcomn.dll`.
Page 571 of 680