SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,492 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility
Detects the import of the specified file to the registry with regedit.exe.
Detects the import of a alternate datastream to the registry with regedit.exe.
Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.
Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers.
Detects REGSVR32.exe to execute DLL hosted on remote shares
Detects potentially suspicious child processes of "regsvr32.exe".
Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance.
Page 75 of 680