Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,097 detections
Filters
Last updated
All Time
Detection languages
501
303
85
65
62
Contributors
265
169
125
111
80
Categories
20,443
11,831
5,872
5,155
4,866
1,097
Platforms
1,096
3
1
1
1
Products / Services
364
351
226
40
32
MITRE Techniques
675
348
323
252
226
CVEs
2
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
4
Detects handles requested to SAM registry hive
Sysmon registry detection of a local hidden user account.
Detects suspicious behavior where a Node.js-based application launches cmd.exe to query MachineGuid from the registry, indicating potential fingerprinting or persistence activity by EvilAi malware. The rule specifically looks for processes initiated from a suspicious folder path, where node.exe is the parent process, and cmd.exe is used to query 'HKLM\Software\Microsoft\Cryptography' for 'MachineGuid'.
Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
Detects potential malicious modification of run keys by winekey or team9 backdoor
A critical remote code execution vulnerability, CVE-2025-59287, affects Windows Server Update Services (WSUS), enabling unauthenticated attackers to execute arbitrary code via unsafe deserialization in the AuthorizationCookie.
Actively exploited since October 2025, this flaw targets WSUS servers on ports 8530/8531, often leaving forensic artifacts like modified SoftwareDistribution.log files and suspicious process chains involving w3wp.exe or wsusservice.exe spawning cmd.exe, powershell.exe, or net.exe.
The provided KQL query for Microsoft Defender XDR correlates network, file, and process events to detect exploitation attempts.
Actively exploited since October 2025, this flaw targets WSUS servers on ports 8530/8531, often leaving forensic artifacts like modified SoftwareDistribution.log files and suspicious process chains involving w3wp.exe or wsusservice.exe spawning cmd.exe, powershell.exe, or net.exe.
The provided KQL query for Microsoft Defender XDR correlates network, file, and process events to detect exploitation attempts.
Monitoring the execution of auditpol.exe can be crutial to detect first-stage of a real attack because they will be shown as previous steps to obfuscate the next execution such a ransomware.
Detects the addition of a Security Support Provider (SSP) to the Windows registry. When an SSP DLL is loaded into the Local Security Authority (LSA) process, typically upon system reboot or via an API call, it gains access to encrypted and plaintext passwords stored in Windows. This technique is often used for persistence and credential access.
This rule detects the creation or modification of a specific registry run key used by the Leviathan APT group for persistence. The key path observed is '\Software\Microsoft\Windows\CurrentVersion\Run\ntkd'. This indicates that a program named 'ntkd' is configured to execute automatically when a user logs in, a common technique for maintaining access to a compromised system.
This rule detects attempts to load malicious DLLs into the LSASS process by modifying undocumented registry keys. Specifically, it looks for modifications to 'DirectoryServiceExtPt' or 'LsaDbExtPt' registry keys that are not associated with the legitimate 'ntdsa.dll' or 'lsadb.dll' files, which are typically loaded by 'lsass.exe' on domain controllers. This technique can be used for privilege escalation, persistence, and credential access.
Detects specific registry markers associated with the FlowCloud malware, which is known to be used by the threat group TA410. The rule identifies unique registry paths where FlowCloud stores its configuration and drivers for its keylogger components.
This rule detects remote procedure calls (RPC) to modify the Windows Registry, which can be indicative of lateral movement or persistence mechanisms. Specifically, it monitors for RPC Firewall events with EventID 3 and an InterfaceUuid corresponding to the Remote Registry Protocol (338cd001-2244-31f1-aaaa-900038001003), focusing on specific operation numbers (OpNum) that represent various registry modification functions. This activity could be used by attackers to establish persistence, evade defenses, or execute code remotely.
Detects remote registry management attempts using the 'reg' utility originating from a workstation not designated as an administrator workstation. This could indicate an attacker attempting to query or modify the registry of a remote system from an unauthorized host.
This rule detects the creation or modification of the 'AppCertDlls' registry key. Adversaries can abuse this registry key to achieve persistence and privilege escalation by causing a malicious DLL to be loaded and executed in the context of other processes. The rule specifically looks for changes to the 'HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls' key or its potential rename.
This rule detects modifications to the AppInit_DLLs registry key, which can be used by adversaries to establish persistence or elevate privileges. DLLs specified in this key are loaded by user32.dll into nearly every process that loads user32.dll. The rule specifically looks for changes to the 'AppInit_Dlls' value within the 'HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows' and 'HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows' registry paths, excluding empty values.
Detects a DNS server error indicating that a specified plugin DLL, configured in the registry, could not be loaded. This event can be triggered by an attacker attempting to load a malicious DLL for privilege escalation or persistence on a DNS server, often associated with techniques like DNSAdmin to DC compromise.
This rule detects attempts to tamper with Sysmon's operational settings by monitoring changes to specific registry keys related to Sysmon's event publishers and channels. Specifically, it looks for modifications that disable Sysmon's 'Enabled' status (EventID 4657, NewValue 0) or attempts to delete the Sysmon operational channel (EventID 4663, AccessMask '0x10000'). This activity could indicate a threat actor trying to evade detection by disabling or muting Sysmon logging.
Detects registry persistence used by the OilRig APT group, specifically looking for modifications to the 'SOFTWARE\Microsoft\Windows\CurrentVersion\UMe' or 'SOFTWARE\Microsoft\Windows\CurrentVersion\UT' registry keys. This activity was reported by Nyotron in their March 2018 report.
Detects the creation or modification of a specific registry key path often used by malware families like IceID and Qakbot for persistence or defense evasion. The rule specifically looks for the registry key ending with '\Software\firm\soft\Name'. This activity has been observed in campaigns distributing malicious OneNote files.
Detects the installation of a new shim database where the file is located in a non-default location. This can be an indicator of persistence or privilege escalation attempts using application shimming.
Detects the usage of wmic.exe to manipulate Windows registry via the WMI StdRegProv class. This behavior could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe. Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.
Page 40 of 53