SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the installation of 'NalDrv' or 'PROCEXP152' services by monitoring registry key modifications. These services are associated with the 'Ghost-In-The-Logs' tool, which leverages KDU for defense evasion. The rule specifically looks for the creation of these service ImagePath registry values in non-system32 folders, filtering out legitimate instances of tools like procexp and procmon.
Detects a specific UAC bypass technique (UACMe 52) that abuses a path parsing vulnerability in `winsat.exe`. This bypass involves modifying registry keys related to `winsat.exe` to point to a malicious executable located in a temporary directory, allowing for privilege escalation without a UAC prompt.
Detects when an attacker registers a new AMSI provider in the Windows Registry to establish persistence. This technique involves creating or modifying registry keys under `SOFTWARE\Microsoft\AMSI\Providers\` or `SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\` to load a malicious DLL when AMSI is initialized. The rule filters out legitimate system processes that might perform similar actions from standard Windows and Program Files directories.
This rule detects attempts to tamper with Windows Attachment Manager settings by modifying specific registry values. These modifications can disable security features related to file attachments, such as hiding zone information, preventing the saving of zone information, or disabling antivirus scanning for downloaded files. Such actions are often performed by adversaries to evade detection and facilitate the execution of malicious files.
Detects potentially suspicious child processes of WinRAR.exe.
Indicates that a password spray attack has been successfully performed.
Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
Detects suspicious DNS queries using base64 encoding
Detects Access to Domain Group Policies stored in SYSVOL
Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
Page 592 of 680