SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,474 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the addition of new root, CA or AuthRoot certificates to the Windows registry
Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages
Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.
Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32" library
Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute
Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.
Detect set Notification_Suppress to 1 to disable the Windows security center notification
Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious commands and strings
Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials
Detects changes to the AppInstaller (winget) admin settings. Such as enabling local manifest installations or disabling installer hash checks
Page 666 of 680