| sigma |
Potential Configuration And Service Reconnaissance Via Reg.EXE |
test |
2026-10-19 |
| splunk |
Windows Hosts File Access |
production |
2026-09-22 |
| splunk |
Windows Credential Access From Browser Password Store |
production |
2026-09-22 |
| elastic |
Enumeration Command Spawned via WMIPrvSE |
production |
2026-09-18 |
| splunk |
Windows Credentials from Password Stores Chrome LocalState Access |
production |
2026-08-14 |
| splunk |
Windows Credentials from Password Stores Chrome Extension Access |
production |
2026-08-14 |
| splunk |
Windows Credentials from Password Stores Chrome Login Data Access |
production |
2026-08-14 |
| splunk |
Windows Query Registry UnInstall Program List |
production |
2026-08-14 |
| splunk |
Windows Non Discord App Access Discord LevelDB |
production |
2026-06-25 |
| sigma |
Registry Enumeration via WMI Stdregprov |
experimental |
2026-06-19 |
| splunk |
Windows Product Key Registry Query |
production |
2026-05-13 |
| splunk |
Windows Post Exploitation Risk Behavior |
production |
2026-05-13 |
| splunk |
Windows Query Registry Browser List Application |
production |
2026-05-13 |
| splunk |
Windows Registry Entries Exported Via Reg |
production |
2026-05-13 |
| splunk |
Windows Registry Entries Restored Via Reg |
production |
2026-05-13 |
| splunk |
Windows Software Discovery Via PowerShell |
production |
2026-05-13 |
| sigma |
HackTool - PCHunter Execution |
test |
2024-11-23 |
| sigma |
Exports Critical Registry Keys To a File |
test |
2024-03-13 |
| sigma |
Exports Registry Key To a File |
test |
2024-03-13 |
| sigma |
Potential Registry Reconnaissance Via PowerShell Script |
test |
2023-07-02 |
| sigma |
Potential Baby Shark Malware Activity |
test |
2023-03-08 |
| sigma |
Operation Wocao Activity - Security |
test |
2022-11-27 |
| sigma |
Azure AD Health Service Agents Registry Keys Access |
test |
2022-10-09 |
| sigma |
Operation Wocao Activity |
test |
2022-10-09 |
| sigma |
Azure AD Health Monitoring Agent Registry Keys Access |
test |
2022-10-09 |
| sigma |
SysKey Registry Keys Access |
test |
2021-11-27 |
| sigma |
SAM Registry Hive Handle Request |
test |
2021-11-27 |
| elastic |
Query Registry via reg.exe |
deprecated |
2021-04-15 |