Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,097 detections
Filters
Last updated
All Time
Detection languages
501
303
85
65
62
Contributors
265
169
125
111
80
Categories
20,443
11,831
5,872
5,155
4,866
1,097
Platforms
1,096
3
1
1
1
Products / Services
364
351
226
40
32
MITRE Techniques
675
348
323
252
226
CVEs
2
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
4
Detects the creation of a scheduled task named '\Windows TeamCity Settings User Interface' with a specific content string 'uTYNkfKxHiZrx3KJ'. This activity has been linked to the Diamond Sleet APT group exploiting the TeamCity CVE-2023-42793 vulnerability for execution, persistence, and privilege escalation.
This rule detects suspicious access to the camera and microphone by processes running from unusual or temporary locations. It monitors registry events related to the CapabilityAccessManager ConsentStore for non-packaged applications. Specifically, it looks for modifications to registry keys that indicate access to 'microphone' or 'webcam' from paths like temporary folders, the Recycle Bin, or public user directories. This behavior can be indicative of malware attempting to record audio or video without user consent.
This rule detects when 'regedit.exe' is used to export a registry key to an Alternate Data Stream (ADS). This technique can be used by adversaries to hide data, such as exported registry keys, within existing files to evade detection. The rule specifically looks for the execution of 'regedit.exe' which is a legitimate Windows utility, making the detection focused on its suspicious usage in conjunction with ADS.
This rule detects attempts by processes to access the microphone and webcam by monitoring specific registry key access events. It looks for EventIDs 4657, 4656, or 4663 associated with registry paths related to the Windows Capability Access Manager's consent store for microphone and webcam access by non-packaged applications. This can indicate an adversary attempting to collect audio or video from the endpoint.
Detects various process execution behaviors associated with the Lazarus Group, including attempts to dump SAM registry hive, network connection enumeration using netstat, network share discovery patterns, persistence mechanisms involving common program data directories, and rundll32 execution with specific file extensions.
Detects the modification of the PortProxy registry key, which is used for port forwarding. This can indicate an adversary setting up a proxy for lateral movement or command and control.
This rule detects the creation or modification of a specific registry key associated with Windows Credential Editor (WCE). WCE is a tool used to dump credentials from memory, specifically targeting the Local Security Authority Subsystem Service (LSASS). The rule looks for the string 'Services\WCESERVICE\Start' within the 'TargetObject' field of registry events, indicating the installation or activation of WCE as a service.
Detects the installation of the Azure Hybrid Connection Manager service by monitoring registry modifications. This service can be used to allow remote code execution from Azure functions, potentially as a method for adversaries to establish persistence or facilitate further access.
Detects Microsoft Outlook attempting to initiate a connection to a WebDAV or SMB share by querying specific registry keys. This behavior is indicative of an exploitation attempt related to CVE-2023-23397, where an attacker could force Outlook to connect to a malicious share and leak NTLM hashes.
This rule detects the creation of scheduled tasks by monitoring specific registry key paths associated with the Windows Task Scheduler. Adversaries often use scheduled tasks for persistence, privilege escalation, or execution of malicious code. By observing modifications to these registry paths, the rule aims to identify when new scheduled tasks are being registered on a system.
Detects attempts to request a handle to the Security Account Manager (SAM) registry hive. Accessing the SAM hive can indicate an adversary attempting to dump credentials.
This rule detects PowerShell scripts that perform potential registry reconnaissance. Specifically, it looks for the use of PowerShell cmdlets like 'Get-Item', 'gci', or 'Get-ChildItem' in conjunction with specific registry paths known to contain system configuration, service information, or autostart entries. Adversaries often query these registry keys to gather information about the system's credentials, configuration, and installed software, which can aid in further compromise or privilege escalation.
This rule detects attempts to access specific registry keys associated with the Windows Local Security Authority (LSA) to calculate the SysKey. SysKey is a critical encryption key used to protect sensitive system information, including password hashes. Adversaries may attempt to extract the SysKey to decrypt credentials or other sensitive data stored in the LSA, often as part of credential dumping activities. The rule specifically looks for Security Event IDs 4656 (A handle to an object was requested) or 4663 (An attempt was made to access an object) where the ObjectType is 'key' and the ObjectName ends with 'lsa\JD', 'lsa\GBG', 'lsa\Skew1', or 'lsa\Data'. These registry paths are known locations where SysKey components are stored.
Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n', which is a known indicator of SNAKE malware activity as described by CISA. This specific registry key is used by SNAKE malware for covert storage.
This rule detects suspicious access attempts to the registry key associated with the Azure AD Health monitoring agent. It specifically looks for Event IDs 4656 (handle to an object was requested) or 4663 (an attempt was made to access an object) on the registry key '\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent'. The rule filters out access attempts made by legitimate Azure AD Health monitoring agent processes to reduce false positives. This detection requires specific SACL auditing to be configured on the registry key.
Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.
This detection identifies suspicious access attempts to registry keys and sub-keys associated with Azure AD Health service agents, such as AD FS. Gaining access to this information could enable an adversary to abuse features provided by these cloud services, particularly federation. The rule requires specific System Access Control List (SACL) auditing to be configured on 'HKLM:\SOFTWARE\Microsoft\ADHealthAgent' with propagation to sub-keys.
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name (SAM or SECURITY) located in the temporary directory have been reset. This behavior can occur when an application attempts to access a hive that has not been recognized for a period (default 7 days). Registry hive dumping utilities such as QuarksPwDump have been observed to exhibit this behavior, which is often associated with credential dumping.
Detects the creation or modification of registry keys related to printer drivers that contain specific strings associated with Mimikatz or the PrinterNightmare vulnerability (CVE-2021-1675, CVE-2021-34527). The rule looks for 'QMS 810' or 'mimikatz' in printer driver paths, or a combination of 'legitprinter' and printer environment paths, or specific strings like 'Gentil Kiwi', 'mimikatz printer', or 'Kiwi Legit Printer' in registry objects related to printing.
Detects the usage of 'reg.exe' to query reconnaissance information from the Windows registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software, specifically looking for common persistence mechanisms and service configurations.
Detects changes to the Windows Registry that configure a monitor program to dump the memory of the lsass.exe process using the SilentProcessExit technique. This method leverages Image File Execution Options (IFEO) to trigger a memory dump of LSASS when it exits, which can be used to extract credentials.
Page 51 of 53