Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,097 detections
Filters
Last updated
All Time
Detection languages
501
303
85
65
62
Contributors
265
169
125
111
80
Categories
20,443
11,831
5,872
5,155
4,866
1,097
Platforms
1,096
3
1
1
1
Products / Services
364
351
226
40
32
MITRE Techniques
675
348
323
252
226
CVEs
2
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
4
Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections'...etc
Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
'This detection looks the prevention of crash dumps being created. This can be used to limit reporting by malware, look for suspicious processes setting this registry key.'
Search for processes modifying the registry to disable security features.
Identify registry modifications that is indicative of a ransom note tied to DEV-0270.
BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption
Detects modification of autostart extensibility point (ASEP) in registry
Detects modification of autostart extensibility point (ASEP) in registry
Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe
Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)
Detects suspicious new RUN key element pointing to an executable in a suspicious folder
Detects changes to the \"DisableRestrictedAdmin\" registry value in order to disable or enable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
Detects modification of autostart extensibility point (ASEP) in registry
Detects potential PowerShell commands or code within registry run keys
Count of sender's email addresses by subject
Find Endpoints policies settings via compliance settings in the registry
Find Mounted ISO files and drive letters
This rule detects suspicious command-line activity indicative of credential access or reconnaissance, as outlined in a CISA 'Living off the Land' report. Specifically, it looks for commands that attempt to list SSH known hosts, access Firefox profiles, execute Mimikatz, query OpenSSH or RealVNC registry keys, or save SAM/SYSTEM registry hives. While individual commands might be benign, their combined presence or repeated execution could signal malicious intent.
This rule detects remote procedure calls (RPC) specifically targeting the Remote Registry Protocol (MS-RRP) interface (UUID: 338cd001-2244-31f1-aaaa-900038001003) for information collection. It filters out common administrative operations (OpNum 6, 7, 8, 13, 18, 19, 21, 22, 23, 35) to reduce false positives, focusing on suspicious reconnaissance activities against the registry from a remote system.
Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process
Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have been known to use this technique to extract sensitive information from the registry.
Page 49 of 53