Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,097 detections
Filters
Last updated
All Time
Detection languages
501
303
85
65
62
Contributors
265
169
125
111
80
Categories
20,443
11,831
5,872
5,155
4,866
1,097
Platforms
1,096
3
1
1
1
Products / Services
364
351
226
40
32
MITRE Techniques
675
348
323
252
226
CVEs
2
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
4
Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)
Detects the presence of a registry key created during Azorult execution
Detects Pandemic Windows Implant
Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured.
Detects actions caused by the RedMimicry Winnti playbook
Sysmon registry detection of a local hidden user account.
Detects a registry key used by IceID in a campaign that distributes malicious OneNote files
Detects potential malicious modification of run keys by winekey or team9 backdoor
Detects abusing Windows 10 Narrator's Feedback-Hub
Detects OilRig registry persistence as reported by Nyotron in their March 2018 report
Detects registry keys created in OceanLotus (also known as APT32) attacks
Detects registry key used by Leviathan APT in Malaysian focused campaign
Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability
Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n' which is a key related to SNAKE malware as described by CISA
Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process
Detects the presence of a registry key created during Azorult execution
Detects Pandemic Windows Implant
Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured.
Sysmon registry detection of a local hidden user account.
Detects NetNTLM downgrade attack
Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
Page 47 of 53