Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,097 detections
Filters
Last updated
All Time
Detection languages
501
303
85
65
62
Contributors
265
169
125
111
80
Categories
20,443
11,831
5,872
5,155
4,866
1,097
Platforms
1,096
3
1
1
1
Products / Services
364
351
226
40
32
MITRE Techniques
675
348
323
252
226
CVEs
2
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
4
This detection identifies a sequence of command-line activities consistent with techniques used by state-sponsored actors. The rule looks for the execution of multiple native Windows reconnaissance or credential dumping commands from a single host and user, which is a common pattern for actors performing hands-on-keyboard operations after gaining initial access.
This detection identifies the deletion of registry keys under HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers\, which store records of previously connected remote systems via Remote Desktop Protocol (RDP). These keys are created automatically when a user connects to a remote host using the native Windows RDP client (mstsc.exe) and can be valuable forensic artifacts for tracking remote access activity. Malicious actors aware of this behavior may delete these keys after using RDP to hide evidence of their activity and avoid detection during incident response. This form of artifact cleanup is a known defense evasion technique, often performed during or after lateral movement. Legitimate users rarely delete these keys manually, making such actions highly suspicious—especially when correlated with RDP usage, unusual logon behavior, or other signs of compromise. Detecting the deletion of these registry entries can provide crucial insight into attempts to cover tracks following interactive remote access.
This rule detects attempts to tamper with Windows Defender's real-time protection settings by monitoring specific registry key modifications. It specifically looks for "TamperingAttempt" actions targeting the 'HKEY_LOCAL_MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\Real-Time Protection' registry key, which is commonly used to disable or modify Windows Defender's real-time scanning capabilities.
The following analytic detects the creation of registry artifacts when an ISO container is opened, clicked, or mounted on a Windows operating system. It leverages data from the Endpoint.Registry data model, specifically monitoring registry keys related to recent ISO or IMG file executions. This activity is significant as adversaries increasingly use container-based phishing campaigns to bypass macro-based document execution controls. If confirmed malicious, this behavior could indicate an initial access attempt, potentially leading to further exploitation, persistence, or data exfiltration within the environment.
Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'. This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level, allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.
Detects the creation of a new HKEY_CLASSES_ROOT (HKCR) shell open command entry that points to an executable in a temporary directory. This persistence technique is used by Warlock Dark Army ransomware.
Detects suspicious registry modifications for IFEO entries which can be used by attackers for persistence.
This is based off of testing with Atomic Red Team tests - https://www.atomicredteam.io/atomic-red-team/atomics/T1546.012
This is based off of testing with Atomic Red Team tests - https://www.atomicredteam.io/atomic-red-team/atomics/T1546.012
Detects dll-sideloading attempts via licensingdiag.exe
Detection of potentially malicious activities on Windows systems related to Sysmon events, focusing on executable files, registry changes, and network connections.
KQL Query from file: Sentinel KQL Detection for ShadowHound
KQL Query from file: DefenderXDR - Devman Ransomware Detection
KQL Query from file: ClickFix_Registry_Related_Artefacts
KQL Query
KQL Query from file: BadSuccessor Detection
KQL Query from file: Detect & mitigate potential Specula Exploitation
Detects the creation or modification of a registry key under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, a common persistence mechanism used by DarkCloud Stealer.
Detects modifications to various Windows Registry keys under `CurrentVersion` that are commonly used for autostart extensibility points (ASEPs). This includes `Run`, `RunOnce`, `RunOnceEx`, `RunServices`, `RunServicesOnce`, `ShellServiceObjectDelayLoad`, `Policies\System\Shell`, `Policies\Explorer\Run`, `Group Policy\Scripts`, `Explorer\ShellServiceObjects`, `Explorer\ShellIconOverlayIdentifiers`, `Explorer\ShellExecuteHooks`, `Explorer\SharedTaskScheduler`, `Explorer\Browser Helper Objects`, `Authentication\PLAP Providers`, `Authentication\Credential Providers`, and `Authentication\Credential Provider Filters`. Adversaries often modify these keys to establish persistence on a system by ensuring their malicious code executes automatically during system boot or user logon.
Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.
DLL Load via LSASS
Sigma
Detects a method to load DLL via LSASS process using an undocumented Registry key
Detects persistence registry keys for Recycle Bin
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen
Page 43 of 53