| sigma |
Outlook Macro Execution Without Warning Setting Enabled |
test |
2023-08-17 |
| sigma |
WinSock2 Autorun Keys Modification |
test |
2023-08-17 |
| sigma |
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting |
test |
2023-08-17 |
| sigma |
Tamper With Sophos AV Registry Keys |
test |
2023-08-17 |
| sigma |
CurrentControlSet Autorun Keys Modification |
test |
2023-08-17 |
| sigma |
Internet Explorer Autorun Keys Modification |
test |
2023-08-17 |
| sigma |
Enable Microsoft Dynamic Data Exchange |
test |
2023-08-17 |
| sigma |
Microsoft Office Protected View Disabled |
test |
2023-08-17 |
| sigma |
ETW Logging Disabled For SCM |
test |
2023-08-17 |
| sigma |
Trust Access Disable For VBApplications |
test |
2023-08-17 |
| sigma |
Persistence Via New SIP Provider |
test |
2023-08-17 |
| sigma |
Activate Suppression of Windows Security Center Notifications |
test |
2023-08-17 |
| sigma |
Suspicious Keyboard Layout Load |
test |
2023-08-17 |
| sigma |
Potentially Suspicious ODBC Driver Registered |
test |
2023-08-17 |
| sigma |
New ODBC Driver Registered |
test |
2023-08-17 |
| sigma |
Suspicious Printer Driver Empty Manufacturer |
test |
2023-08-17 |
| sigma |
Potential Process Execution Proxy Via CL_Invocation.ps1 |
test |
2023-08-17 |
| sigma |
Assembly Loading Via CL_LoadAssembly.ps1 |
test |
2023-08-17 |
| sigma |
Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 |
test |
2023-08-17 |
| sigma |
Suspicious Environment Variable Has Been Registered |
test |
2023-08-17 |
| sigma |
Potential Credential Dumping Attempt Using New NetworkProvider - REG |
test |
2023-08-17 |
| sigma |
New Application in AppCompat |
test |
2023-08-17 |
| sigma |
Running Chrome VPN Extensions via the Registry 2 VPN Extension |
test |
2023-08-17 |
| sigma |
NET NGenAssemblyUsageLog Registry Key Tamper |
test |
2023-08-17 |
| sigma |
Lsass Full Dump Request Via DumpType Registry Settings |
test |
2023-08-17 |
| sigma |
UAC Bypass Using Windows Media Player - Registry |
test |
2023-08-17 |
| sigma |
UAC Bypass Abusing Winsat Path Parsing - Registry |
test |
2023-08-17 |
| sigma |
Lolbas OneDriveStandaloneUpdater.exe Proxy Download |
test |
2023-08-17 |
| sigma |
Bypass UAC Using DelegateExecute |
test |
2023-08-17 |
| sigma |
Potential Ransomware Activity Using LegalNotice Message |
test |
2023-08-17 |
| sigma |
VBScript Payload Stored in Registry |
test |
2023-08-17 |
| sigma |
New Root or CA or AuthRoot Certificate to Store |
test |
2023-08-17 |
| sigma |
Registry Hide Function from User |
test |
2023-08-17 |
| sigma |
Scripted Diagnostics Turn Off Check Enabled - Registry |
test |
2023-08-17 |
| sigma |
Registry Modification to Hidden File Extension |
test |
2023-08-17 |
| sigma |
Persistence Via Hhctrl.ocx |
test |
2023-08-17 |
| sigma |
Potential Signing Bypass Via Windows Developer Features - Registry |
test |
2023-08-17 |
| sigma |
UAC Bypass via Sdclt |
test |
2023-08-17 |
| sigma |
Outlook Task/Note Reminder Received |
test |
2023-08-17 |
| sigma |
Potential EventLog File Location Tampering |
test |
2023-08-17 |