Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,097 detections
Filters
Last updated
All Time
Detection languages
501
303
85
65
62
Contributors
265
169
125
111
80
Categories
20,443
11,831
5,872
5,155
4,866
1,097
Platforms
1,096
3
1
1
1
Products / Services
364
351
226
40
32
MITRE Techniques
675
348
323
252
226
CVEs
2
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
4
This rule detects PowerShell scripts that attempt to retrieve Access Control Lists (ACLs) for service-related registry keys under HKLM\SYSTEM\CurrentControlSet\Services. This activity could indicate an adversary performing reconnaissance for service registry permissions weaknesses, which can be exploited for privilege escalation or persistence. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services if permissions are misconfigured.
Detects the use of 'regedit.exe' to import a registry file that originates from an Alternate Data Stream (ADS). This technique can be used by adversaries for persistence, defense evasion, or to modify system configurations by importing registry keys from hidden data streams.
Detects the presence of a registry key created during Azorult malware execution. Specifically, it looks for modifications to registry keys ending with '\services\localNETService' within the 'SYSTEM\' hive, which is a known indicator for Azorult.
This rule detects attempts to establish persistence or escalate privileges by abusing the Windows 10 Narrator's Feedback-Hub. Specifically, it looks for the deletion of the 'DelegateExecute' value or modification of the '(Default)' value within a specific registry key associated with the Feedback-Hub application. This technique can be used by an attacker to inject a malicious payload that will execute when the Narrator's Feedback-Hub is launched.
Detects potential malicious modification of the 'Run' registry key by malware identified as 'winekey' or 'team9' (Bazar/KEGTAP) to establish persistence. Specifically, it looks for modifications to the 'Software\Microsoft\Windows\CurrentVersion\Run\Backup Mgr' registry value.
Detects modifications to the 'HKLM\SOFTWARE\Microsoft\HTMLHelp\data' registry key, which is associated with the RedMimicry Winnti playbook. This registry key can be used for persistence or defense evasion by adversaries.
This rule detects modifications to the 'Run Once' registry key, specifically targeting the 'StubPath' value within 'Microsoft\Active Setup\Installed Components'. This registry key is often used by legitimate applications for one-time execution tasks, but adversaries can abuse it to establish persistence or execute malicious payloads. The rule includes filters to exclude common legitimate modifications made by Google Chrome and Microsoft Edge installers, which frequently use this mechanism.
Detects attempts to establish persistence by modifying registry keys associated with the Recycle Bin. This technique leverages the Recycle Bin's CLSID to execute arbitrary commands, often for privilege escalation or maintaining access.
Detects the import of '.reg' files from suspicious user-controlled or temporary paths using the 'reg.exe' utility. This activity can be indicative of an adversary attempting to modify the Windows Registry for persistence, defense evasion, or other malicious purposes by importing registry keys from a location that is easily written to.
Detects the use of regedit.exe to import a registry file (.reg) into the Windows Registry. This activity can be used by adversaries for various purposes, including establishing persistence, modifying system configurations, or defense evasion.
This analytic identifies the creation of WMI Event Subscriptions, which can be used to establish persistence or perform privilege escalation. It specifically detects EventID 20 (EventConsumer creation) from Sysmon logs. WMI Event Subscriptions can execute code with elevated SYSTEM privileges, making them a powerful persistence mechanism. If confirmed malicious, an attacker could maintain long-term access, escalate privileges, and execute arbitrary code, posing a severe threat to the environment.
Detects attempts to harvest credentials by enabling the RemoteRegistry service or dumping the SAM, SECURITY, or SYSTEM registry hives, which are behaviors associated with the Flax Typhoon APT group.
This analytic is used to identify when a removable media device is attached to a machine and then a process is executed from the same drive letter assigned to the removable media device. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
The analytic detects unauthorized access to Outlook credentials stored in the Windows registry. It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles. This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts. If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk.
This analytic identifies processes accessing Intelliform Storage Registry keys used by Internet Explorer, excluding legitimate Internet Explorer and dllhost processes. This activity is significant because it can indicate unauthorized access or manipulation of sensitive registry keys used for storing form data in Internet Explorer, potentially leading to data exfiltration, credential theft, or further system compromise.
The threat actor created an account using the net user command. When a $ is added to the end of the account name during account creation, the account is created with a hidden attribute. In this case, the account cannot be identified using the (net user command), and can only be identified in the SAM registry. In a RID Hijacking attack, threat actors modify the RID value of an account in the SAM registry so that the Windows operating system recognizes it as a changed RID. In the Windows operating system, the registry key related to user accounts are stored in the path HKEY_LOCAL_MACHINE\ SAM\SAM\Domains\Account\Users. The RID of a user account is written in the little-endian format as 4 bytes in the 0x30 0x33 area of the F value under each account key. Threat actors change the value at this offset to the RID of the hijacking target.
Detects abusing Windows 10 Narrator's Feedback-Hub
DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll
Detects persistence registry keys for Recycle Bin
Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories
DLL Load via LSASS
Sigma
Detects a method to load DLL via LSASS process using an undocumented Registry key
Page 41 of 53