Rule Library

Sigma Rules

916 rules found for "Microsoft"

3,707Total
3,116Detection
451Emerging
137Hunting
Threat Huntmediumtest

File or Folder Permissions Modifications

Detects a file or folder's permissions being modified or tampered with.

WindowsProcess Creation
TA0005 · Defense Evasionattack.t1222.001detection.threat-hunting
Jakob Weinzettl+2Wed Oct 23windows
Threat Huntmediumtest

Use Short Name Path in Command Line

Detects the use of short name paths (8.3 format) in command lines, which can be used to obfuscate paths or access restricted locations. Windows creates short 8.3 filenames (like PROGRA~1) for compatibility with MS-DOS-based or 16-bit Windows programs. When investigating, examine: - Commands using short paths to access sensitive directories or files - Web servers on Windows (especially Apache) where short filenames could bypass security controls - Correlation with other suspicious behaviors - baseline of short name usage in your environment and look for deviations

WindowsProcess Creation
TA0005 · Defense EvasionT1564.004 · NTFS File Attributesdetection.threat-hunting
François Hubaut+1Sun Aug 07windows
Threat Huntmediumtest

Microsoft Office Trusted Location Updated

Detects changes to the registry keys related to "Trusted Location" of Microsoft Office. Attackers might add additional trusted locations to avoid macro security restrictions.

WindowsRegistry Set
TA0005 · Defense EvasionTA0003 · PersistenceT1112 · Modify Registrydetection.threat-hunting
Nasreddine Bencherchali (Nextron Systems)Wed Jun 21windows
Threat Huntmediumtest

Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace

Detects the setting of a registry inside the "\Shell\Open\Command" value with PowerShell classes from the "System.Security.Cryptography" namespace. The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption. These can be used for example in decrypting malicious payload for defense evasion.

WindowsRegistry Set
TA0005 · Defense EvasionTA0002 · ExecutionTA0003 · PersistenceTA0004 · Privilege Escalation+4
Andreas Braathen (mnemonic.io)Fri Dec 01windows