| sigma |
Masquerading as Linux Crond Process |
test |
2023-08-22 |
| sigma |
Potentially Suspicious WebDAV LNK Execution |
test |
2023-08-21 |
| sigma |
WebDAV Temporary Local File Creation |
test |
2023-08-21 |
| sigma |
New ODBC Driver Registered |
test |
2023-08-17 |
| sigma |
VBScript Payload Stored in Registry |
test |
2023-08-17 |
| sigma |
Scripted Diagnostics Turn Off Check Enabled - Registry |
test |
2023-08-17 |
| sigma |
Potential Signing Bypass Via Windows Developer Features - Registry |
test |
2023-08-17 |
| sigma |
UAC Bypass via Sdclt |
test |
2023-08-17 |
| sigma |
UAC Bypass Abusing Winsat Path Parsing - Registry |
test |
2023-08-17 |
| sigma |
UAC Bypass Using Windows Media Player - Registry |
test |
2023-08-17 |
| sigma |
Execution DLL of Choice Using WAB.EXE |
test |
2023-08-17 |
| sigma |
Wdigest Enable UseLogonCredential |
test |
2023-08-17 |
| sigma |
Winget Admin Settings Modification |
test |
2023-08-17 |
| sigma |
Enable Local Manifest Installation With Winget |
test |
2023-08-17 |
| sigma |
Winlogon AllowMultipleTSSessions Enable |
test |
2023-08-17 |
| sigma |
Winlogon Notify Key Logon Persistence |
test |
2023-08-17 |
| sigma |
Small Sieve Malware Registry Persistence |
test |
2023-08-17 |
| sigma |
Suspicious Set Value of MSDT in Registry (CVE-2022-30190) |
test |
2023-08-17 |
| sigma |
Potential EventLog File Location Tampering |
test |
2023-08-17 |
| sigma |
Potentially Suspicious ODBC Driver Registered |
test |
2023-08-17 |
| sigma |
Trust Access Disable For VBApplications |
test |
2023-08-17 |
| sigma |
Potential Credential Dumping Attempt Using New NetworkProvider - REG |
test |
2023-08-17 |
| sigma |
New Application in AppCompat |
test |
2023-08-17 |
| sigma |
Microsoft Office Protected View Disabled |
test |
2023-08-17 |
| sigma |
Enable Microsoft Dynamic Data Exchange |
test |
2023-08-17 |
| sigma |
NET NGenAssemblyUsageLog Registry Key Tamper |
test |
2023-08-17 |
| sigma |
Lsass Full Dump Request Via DumpType Registry Settings |
test |
2023-08-17 |
| sigma |
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting |
test |
2023-08-17 |
| sigma |
Lolbas OneDriveStandaloneUpdater.exe Proxy Download |
test |
2023-08-17 |
| sigma |
Potential Ransomware Activity Using LegalNotice Message |
test |
2023-08-17 |
| sigma |
New Root or CA or AuthRoot Certificate to Store |
test |
2023-08-17 |
| sigma |
Outlook Macro Execution Without Warning Setting Enabled |
test |
2023-08-17 |
| sigma |
Outlook EnableUnsafeClientMailRules Setting Enabled - Registry |
test |
2023-08-17 |
| sigma |
Macro Enabled In A Potentially Suspicious Document |
test |
2023-08-17 |
| sigma |
ETW Logging Disabled For rpcrt4.dll |
test |
2023-08-17 |
| sigma |
Tamper With Sophos AV Registry Keys |
test |
2023-08-17 |
| sigma |
Registry Hide Function from User |
test |
2023-08-17 |
| sigma |
ETW Logging Disabled For SCM |
test |
2023-08-17 |
| sigma |
Persistence Via New SIP Provider |
test |
2023-08-17 |
| sigma |
Registry Modification to Hidden File Extension |
test |
2023-08-17 |