SigmaHQ Detections
@sigmaHQ12 followers122,464 downloads2,593 copies16 likes160,474 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests.
Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.
Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.
PktMon.EXE Execution
Sigma
Detects execution of PktMon, a tool that captures network packets.
Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension
Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence
Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.
Detects execution of "reg.exe" to disable security services such as Windows Defender.
Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys
Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.
Detects potentially suspicious child processes of "GoogleUpdate.exe"
Page 667 of 680