| sigma |
Wow6432Node Classes Autorun Keys Modification |
test |
2023-08-17 |
| sigma |
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting |
test |
2023-08-17 |
| sigma |
Macro Enabled In A Potentially Suspicious Document |
test |
2023-08-17 |
| sigma |
Microsoft Office Protected View Disabled |
test |
2023-08-17 |
| sigma |
Trust Access Disable For VBApplications |
test |
2023-08-17 |
| sigma |
Potentially Suspicious ODBC Driver Registered |
test |
2023-08-17 |
| sigma |
New ODBC Driver Registered |
test |
2023-08-17 |
| sigma |
Persistence Via Hhctrl.ocx |
test |
2023-08-17 |
| sigma |
Potential Credential Dumping Attempt Using New NetworkProvider - REG |
test |
2023-08-17 |
| sigma |
New Application in AppCompat |
test |
2023-08-17 |
| sigma |
Outlook Task/Note Reminder Received |
test |
2023-08-17 |
| sigma |
NET NGenAssemblyUsageLog Registry Key Tamper |
test |
2023-08-17 |
| sigma |
Lsass Full Dump Request Via DumpType Registry Settings |
test |
2023-08-17 |
| sigma |
Lolbas OneDriveStandaloneUpdater.exe Proxy Download |
test |
2023-08-17 |
| sigma |
Potential Ransomware Activity Using LegalNotice Message |
test |
2023-08-17 |
| sigma |
New Root or CA or AuthRoot Certificate to Store |
test |
2023-08-17 |
| sigma |
Registry Hide Function from User |
test |
2023-08-17 |
| sigma |
Registry Modification to Hidden File Extension |
test |
2023-08-17 |
| sigma |
Outlook EnableUnsafeClientMailRules Setting Enabled - Registry |
test |
2023-08-17 |
| sigma |
Outlook Macro Execution Without Warning Setting Enabled |
test |
2023-08-17 |
| sigma |
Enable Microsoft Dynamic Data Exchange |
test |
2023-08-17 |
| sigma |
Potential Registry Persistence Attempt Via Windows Telemetry |
test |
2023-08-17 |
| sigma |
Disable Windows Security Center Notifications |
test |
2023-08-17 |
| sigma |
Registry Disable System Restore |
test |
2023-08-17 |
| sigma |
Tamper With Sophos AV Registry Keys |
test |
2023-08-17 |
| sigma |
Suspicious Set Value of MSDT in Registry (CVE-2022-30190) |
test |
2023-08-17 |
| sigma |
Small Sieve Malware Registry Persistence |
test |
2023-08-17 |
| sigma |
DHCP Callout DLL Installation |
test |
2023-08-17 |
| sigma |
Disable Exploit Guard Network Protection on Windows Defender |
test |
2023-08-17 |
| sigma |
Internet Explorer Autorun Keys Modification |
test |
2023-08-17 |
| sigma |
ETW Logging Disabled For SCM |
test |
2023-08-17 |
| sigma |
Suspicious Printer Driver Empty Manufacturer |
test |
2023-08-17 |
| sigma |
ETW Logging Disabled For rpcrt4.dll |
test |
2023-08-17 |
| sigma |
Potential Encrypted Registry Blob Related To SNAKE Malware |
test |
2023-08-17 |
| sigma |
Add DisallowRun Execution to Registry |
test |
2023-08-17 |
| sigma |
Suspicious Environment Variable Has Been Registered |
test |
2023-08-17 |
| sigma |
Disable Macro Runtime Scan Scope |
test |
2023-08-17 |
| sigma |
Persistence Via Disk Cleanup Handler - Autorun |
test |
2023-08-17 |
| sigma |
CrashControl CrashDump Disabled |
test |
2023-08-17 |
| sigma |
Winlogon Notify Key Logon Persistence |
test |
2023-08-17 |