SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands.
Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" registry key.
This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.
Detects when an attacker tries to hide from Sysmon by disabling or stopping it
Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy
Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer.
Detects the modification of the registry to disable a system restore on the computer
Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe
Detects wscript/cscript/mshta executions of scripts located in user directories
Page 82 of 680