Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,097 detections
Filters
Last updated
All Time
Detection languages
501
303
85
65
62
Contributors
265
169
125
111
80
Categories
20,443
11,831
5,872
5,155
4,866
1,097
Platforms
1,096
3
1
1
1
Products / Services
364
351
226
40
32
MITRE Techniques
675
348
323
252
226
CVEs
2
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
4
Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.
Detects Processes accessing the camera and microphone from suspicious folder
Detects the modification of the PortProxy registry key which is used for port forwarding.
Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started
Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability
Detects the use of Windows Credential Editor (WCE)
Detects potential malicious modification of the property value of IsCredGuardEnabled from
HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system.
This is usually used with UseLogonCredential to manipulate the caching credentials.
HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system.
This is usually used with UseLogonCredential to manipulate the caching credentials.
DLL Load via LSASS
Sigma
Detects a method to load DLL via LSASS process using an undocumented Registry key
Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects FlowCloud malware registry markers from threat group TA410.
The malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components.
The malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components.
Alerts on trust record modification within the registry, indicating usage of macros
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen
Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527
Detects FlowCloud malware registry markers from threat group TA410.
The malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components.
The malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components.
Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n' which is a key related to SNAKE malware as described by CISA
Detects NetNTLM downgrade attack
Detects the modification of the PortProxy registry key which is used for port forwarding.
Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories
Detects actions caused by the RedMimicry Winnti playbook
Page 44 of 53