Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,097 detections
Filters
Last updated
All Time
Detection languages
501
303
85
65
62
Contributors
265
169
125
111
80
Categories
20,401
11,795
5,864
5,145
4,864
1,097
Platforms
1,096
3
1
1
1
Products / Services
364
351
226
40
32
MITRE Techniques
675
348
323
252
226
CVEs
2
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
4
This rule detects attempts to query the list of services on a remote Windows host via the Remote Registry service. It specifically looks for the string "HKLM\System\CurrentControlSet\Services" over TCP port 445 (SMB/CIFS), which is commonly used for Remote Registry access. A threshold of 10 occurrences within 30 seconds from the same source IP is set to reduce false positives.
Detects the use of regedit.exe to silently or explicitly import a .reg file located in the C:\ProgramData\ directory. This technique is used by threat actors, such as those deploying Nimbus RAT, to establish persistence.
Detects registry modifications to the specific CLSID {722D0F89-B69C-4700-AE8C-4A44350E4876} utilized by the Argamal RAT's Stage 1 PowerShell script. This establishes initial persistence to later download and decrypt the final payload.
Detects the creation or modification of a registry run key that masquerades as 'WindowsUpdate' and points to an executable within a 'Temp' directory with a specific naming pattern (e.g., 'winupd_[a-z0-9]+.exe'). This technique is commonly used by adversaries to establish persistence on a system by ensuring their malicious payload executes upon user login.
Detects processes modifying or querying Windows Defender registry keys related to Potentially Unwanted Application (PUA) protection (PUAProtection, MpEnablePus). This behavior is observed in the SessionGate malware to verify its execution environment and evade detection before deploying further payloads.
Detects Atlas RAT anti-analysis behavior by monitoring for interactions with the Windows Defender Application Guard (WDAG) RunOnce registry key. This is a known sandbox evasion technique used by TA4922 before executing its primary payload.
Detects PowerShell executions associated with Gamaredon's GammaSteel persistence mechanism, which reconstructs a payload path from the HKCU:\Printers registry key and executes it using [scriptblock]::Create. This technique indicates an attempt to maintain access by leveraging registry keys for autostart execution and dynamic script execution.
Detects COM hijacking of the Windows Color System Calibration Loader CLSID ({B210D694-C8DF-490D-9576-9E20CDBC20BD}). The Argamal RAT abuses this specific CLSID by modifying the InprocServer32 key in the user hive to establish startup persistence tied to user login via a default Windows scheduled task.
Detects attempts to bypass User Account Control (UAC) by hijacking the execution flow of the auto-elevated fodhelper.exe binary via modifications to the ms-settings registry keys in the HKCU hive. Silent Stealer leverages this specific registry hijack to seamlessly gain elevated privileges without triggering user prompts, an essential step for its deep credential extraction processes.
Detects when a user executes more than 3 commands via the Windows Run dialog, as indicated by entries in the 'Explorer\RunMRU' registry key. This activity could be indicative of an attacker performing reconnaissance or executing multiple commands, or it could be a legitimate power user or administrator activity.
Identifies registry Run or RunOnce keys being created or modified with a specific 'Update Drivers NVIDEO' naming convention, which has been observed as a persistence mechanism used by the DesckVB malware.
Detects Atlas RAT anti-analysis behavior by monitoring for registry queries or interactions with the Windows Defender Application Guard (WDAG) RunOnce registry key. This rule specifically looks for registry events where the key name contains "RunOnce" and the value name contains "WDAG", indicating an attempt by malware to detect or interact with a sandbox environment.
Detects registry interactions querying or accessing the Windows Defender Application Guard (WDAG) RunOnce registry key. This behavior is associated with Atlas RAT performing anti-sandbox and anti-analysis checks prior to payload execution.
Detects modification of the InprocServer32 key for the Windows Color System Calibration CLSID, a persistence mechanism actively abused by the Argamal RAT to establish startup persistence tied to user login via a default Windows scheduled task.
This rule detects the creation of scheduled tasks using `schtasks.exe` or `at.exe` with specific command-line arguments (`/create`, `/tn`, and either `/ru` or `/tr`). It then correlates these process events with registry events related to Task Scheduler keys or values containing "Task" to identify potential persistence mechanisms.
Detects a write to windir under USER\.DEFAULT\Volatile Environment, the core primitive of CVE-2020-17103 (MiniPlasma). Writing windir here causes the WER QueueReporting scheduled task to execute wermgr.exe from an attacker-controlled path as SYSTEM instead of the legitimate C:\Windows\System32\wermgr.exe, achieving local privilege escalation. No legitimate software writes to this key.
This rule detects the creation or modification of registry keys under 'HKCU\SOFTWARE\TitanPlus' or 'HKLM\SOFTWARE\TitanPlus' that contain specific IP addresses (38.180.25, 45.8.157, or 5.181.3) in their details. This activity is associated with Black Basta and Cactus ransomware for storing BackConnect C2 IP addresses.
Detects creation or modification of the SafeBoot\Network\Remote Access Service registry key, a persistence mechanism used by the STAC6405 (VENOMOUS#HELPER) campaign. This ensures the SimpleHelp-based RAT survives Safe Mode with Networking reboots, which is a common remediation step for defenders. The specific 'Remote Access Service' subkey under SafeBoot\Network is a static Indicator of Compromise (IOC) for this campaign, as modifications to SafeBoot\Network are generally rare in benign Windows operations.
Detects registry modifications aimed at disabling critical Windows utilities (Task Manager, Registry Editor) or degrading the user interface (swapping mouse buttons, hiding desktop icons). These behaviors are indicative of the CrystalX 'Rofl' prankware and disruption module.
Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'.
This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level,
allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.
This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level,
allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.
Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events.
Page 37 of 53