Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,097 detections
Filters
Last updated
All Time
Detection languages
501
303
85
65
62
Contributors
265
169
125
111
80
Categories
20,443
11,831
5,872
5,155
4,866
1,097
Platforms
1,096
3
1
1
1
Products / Services
364
351
226
40
32
MITRE Techniques
675
348
323
252
226
CVEs
2
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
4
Detects the installation or execution of unauthorized Remote Monitoring and Management (RMM) tools such as MeshCentral, Atera, Teramind, AnyDesk, or AdaptixC2 artifacts on endpoints. It flags devices running multiple distinct RMM tools or featuring AdaptixC2.
Detects observable hiding actions targeting ScreenConnect (ConnectWise Control) clients, such as modifying registry keys to hide uninstall entries, using attrib.exe to set hidden attributes, or launching management tools with hidden window styles.
Detects potential cryptocurrency clipper malware by monitoring the staging of multiple attacker wallet addresses (BTC, ETH, TRC) under the HKCU\Software\Clipper registry path by a non-system process.
Detects when a process modifies the Windows Registry to disable zone checks (SEE_MASK_NOZONECHECKS) in the Environment key and alters settings to show hidden files (ShowSuerHidden) within 30 minutes on the same device. This behavior is commonly associated with malware attempting to execute downloaded payloads without security prompts while concealing artifacts.
Detects registry-based User Account Control (UAC) bypass activity where command keys for ms-settings or mscfile are created or modified under HKCU Software\Classes, correlated with a privilege adjustment (SeDebugPrivilege or SeLoadDriverPrivilege) by the same process within a 30-minute window.
Detects persistence mechanisms established via Registry Run/RunOnce keys, Startup folder modifications, or scheduled task creation using specific tool names such as client32 or pcictlui.
Detects AppInit DLL registry modifications referencing DLLs located in user-writable directories (such as AppData, Temp, Users\Public, or Downloads), which may indicate adversary persistence or process injection configuration.
Detects the persistence mechanism used by ShelbyLoader V2 (RuntimeBroker.dll), the loader in the Iran-nexus Blinder Tunnel campaign (CL-STA-1178). The implant writes HKCU\...\Run\MicrosoftRuntime pointing at %LOCALAPPDATA%\Microsoft\RuntimeBrokers\RuntimeBroker.exe, then re-asserts it hourly. The genuine RuntimeBroker.exe is a System32 COM broker that is never autostarted from a Run key, so matching either the implant’s value name or RuntimeBroker.exe in Run data gives a near-binary signal with no allow-list. Covers both the Unit 42 and Nextron variants.
Generic rule content from file: Iranian APT - Blinder Tunnel - MicrosoftRuntime Run Key Persistence.cql
The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
Detects Sysmon registry events (EventCode 12, 13, 14) writing Run/RunOnce keys or Service ImagePath values that reference esetservice.exe from a user-writable path (AppData, ProgramData, Temp, Public, Downloads), excluding the legitimate Program Files\ESET install location.
The following analytic detects suspicious modifications to the EventLog security descriptor registry value for defense evasion. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CustomSD" value within the "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\<Channel>\CustomSD" path. This activity is significant as changes to the access permissions of the event log could blind security products and help attackers evade defenses. If confirmed malicious, this could allow attackers to block users and security products from viewing, ingesting and interacting event logs.
The following analytic detects modifications to the registry that disable the Event Tracing for Windows (ETW) feature. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" with a value set to "0x00000000". This activity is significant because disabling ETW can allow attackers to evade detection mechanisms, making it harder for security tools to monitor malicious activities. If confirmed malicious, this could enable attackers to execute payloads with minimal alerts, impairing defenses and potentially leading to further compromise of the system.
The following analytic detects modifications to the Windows registry key "DisableRemoteDesktopAntiAlias" with a value set to 0x00000001. This detection leverages data from the Endpoint datamodel, specifically monitoring changes in the Registry node. This activity is significant as it may indicate the presence of DarkGate malware, which alters this registry setting to enhance its remote desktop capabilities. If confirmed malicious, this modification could allow an attacker to maintain persistence and control over the compromised host, potentially leading to further exploitation and data exfiltration.
The following analytic detects a suspicious modification to the Windows registry setting for EnableLinkedConnections. It leverages data from the Endpoint.Registry datamodel to identify changes where the registry path is "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLinkedConnections" and the value is set to "0x00000001". This activity is significant because enabling linked connections can allow network shares to be accessed with both standard and administrator-level privileges, a technique often abused by malware like BlackByte ransomware. If confirmed malicious, this could lead to unauthorized access to sensitive network resources, escalating the attacker's privileges.
The following analytic identifies a suspicious modification of the Windows registry setting for max connections per server. It detects changes to specific registry paths using data from the Endpoint.Registry datamodel. This activity is significant because altering this setting can be exploited by attackers to increase the number of concurrent connections to a remote server, potentially facilitating DDoS attacks or enabling more effective lateral movement within a compromised network. If confirmed malicious, this could lead to network disruption or further compromise of additional systems.
The following analytic detects modifications to the Windows RunMRU registry key, which stores a history of commands executed through the Run dialog box (Windows+R). It leverages Endpoint Detection and Response (EDR) telemetry to monitor registry events targeting this key. This activity is significant as malware often uses the Run dialog to execute malicious commands while attempting to appear legitimate. If confirmed malicious, this could indicate an attacker using indirect command execution techniques for defense evasion or persistence. The detection excludes MRUList value changes to focus on actual command entries.
The following analytic identifies modifications in the registry to disable Windows Defender's real-time behavior monitoring. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with Windows Defender settings. This activity is significant because disabling real-time protection is a common tactic used by malware such as RATs, bots, or Trojans to evade detection. If confirmed malicious, this action could allow an attacker to execute code, escalate privileges, or persist in the environment without being detected by antivirus software.
The following analytic detects a suspicious registry modification that enables the plain text credential feature in Windows by setting the "UseLogonCredential" value to 1 in the WDigest registry path. This detection leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values. This activity is significant because it is commonly used by malware and tools like Mimikatz to dump plain text credentials, indicating a potential credential dumping attempt. If confirmed malicious, this could allow an attacker to obtain sensitive credentials, leading to further compromise and lateral movement within the network.
The following analytic identifies modifications to registry keys commonly used for persistence mechanisms. It leverages data from endpoint detection sources like Sysmon or Carbon Black, focusing on specific registry paths known to initiate applications or services during system startup. This activity is significant as unauthorized changes to these keys can indicate attempts to maintain persistence or execute malicious actions upon system boot. If confirmed malicious, this could allow attackers to achieve persistent access, execute arbitrary code, or maintain control over compromised systems, posing a severe threat to system integrity and security.
The following analytic detects modifications in the Windows registry to suppress Windows Defender notifications. It leverages data from the Endpoint.Registry datamodel, specifically targeting changes to the "Notification_Suppress" registry value. This activity is significant because adversaries, including those deploying Azorult malware, use this technique to bypass Windows Defender and disable critical notifications. If confirmed malicious, this behavior could allow attackers to evade detection, maintain persistence, and execute further malicious activities without alerting the user or security tools.
Page 1 of 53