| sigma |
Potential Credential Dumping Attempt Using New NetworkProvider - REG |
test |
2023-08-17 |
| sigma |
New ODBC Driver Registered |
test |
2023-08-17 |
| sigma |
Potentially Suspicious ODBC Driver Registered |
test |
2023-08-17 |
| sigma |
Trust Access Disable For VBApplications |
test |
2023-08-17 |
| sigma |
Microsoft Office Protected View Disabled |
test |
2023-08-17 |
| sigma |
Potential EventLog File Location Tampering |
test |
2023-08-17 |
| sigma |
ClickOnce Trust Prompt Tampering |
test |
2023-08-17 |
| sigma |
IE Change Domain Zone |
test |
2023-08-17 |
| sigma |
Bypass UAC Using Event Viewer |
test |
2023-08-17 |
| sigma |
Bypass UAC Using DelegateExecute |
test |
2023-08-17 |
| sigma |
CurrentControlSet Autorun Keys Modification |
test |
2023-08-17 |
| sigma |
Potential AMSI COM Server Hijacking |
test |
2023-08-17 |
| sigma |
Allow RDP Remote Assistance Feature |
test |
2023-08-17 |
| sigma |
Add Debugger Entry To AeDebug For Persistence |
test |
2023-08-17 |
| sigma |
Windows Defender Exclusions Added - Registry |
test |
2023-08-17 |
| sigma |
DHCP Callout DLL Installation |
test |
2023-08-17 |
| sigma |
Disable Macro Runtime Scan Scope |
test |
2023-08-17 |
| sigma |
Disable Privacy Settings Experience in Registry |
test |
2023-08-17 |
| sigma |
Disable Windows Firewall by Registry |
test |
2023-08-17 |
| sigma |
Disable Windows Security Center Notifications |
test |
2023-08-17 |
| sigma |
Registry Disable System Restore |
test |
2023-08-17 |
| sigma |
Disabled Windows Defender Eventlog |
test |
2023-08-17 |
| sigma |
Disable PUA Protection on Windows Defender |
test |
2023-08-17 |
| sigma |
Disable Tamper Protection on Windows Defender |
test |
2023-08-17 |
| sigma |
Add DisallowRun Execution to Registry |
test |
2023-08-17 |
| sigma |
Persistence Via Disk Cleanup Handler - Autorun |
test |
2023-08-17 |
| sigma |
DNS-over-HTTPS Enabled by Registry |
test |
2023-08-17 |
| sigma |
New DNS ServerLevelPluginDll Installed |
test |
2023-08-17 |
| sigma |
ETW Logging Disabled In .NET Processes - Sysmon Registry |
test |
2023-08-17 |
| sigma |
Scripted Diagnostics Turn Off Check Enabled - Registry |
test |
2023-08-17 |
| sigma |
Suspicious Application Allowed Through Exploit Guard |
test |
2023-08-17 |
| sigma |
New File Association Using Exefile |
test |
2023-08-17 |
| sigma |
Add Debugger Entry To Hangs Key For Persistence |
test |
2023-08-17 |
| sigma |
Enable Microsoft Dynamic Data Exchange |
test |
2023-08-17 |
| sigma |
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting |
test |
2023-08-17 |
| sigma |
Outlook Macro Execution Without Warning Setting Enabled |
test |
2023-08-17 |
| sigma |
Outlook EnableUnsafeClientMailRules Setting Enabled - Registry |
test |
2023-08-17 |
| sigma |
Macro Enabled In A Potentially Suspicious Document |
test |
2023-08-17 |
| sigma |
Potential Persistence Via App Paths Default Property |
test |
2023-08-17 |
| sigma |
Potential Persistence Using DebugPath |
test |
2023-08-17 |