Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,097 detections
Filters
Last updated
All Time
Detection languages
501
303
85
65
62
Contributors
265
169
125
111
80
Categories
20,443
11,831
5,872
5,155
4,866
1,097
Platforms
1,096
3
1
1
1
Products / Services
364
351
226
40
32
MITRE Techniques
675
348
323
252
226
CVEs
2
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
4
Detects the use of esentutl.exe to interact with Volume Shadow Copy Service (VSS) registry keys. This activity can be indicative of attempts to access or dump credentials, particularly from the Security Account Manager (SAM) database, which is often stored in the registry and can be targeted via VSS snapshots.
Detects modification of the registry key that specifies the path to the screensaver binary. This can be abused by adversaries to establish persistence or elevate privileges by executing malicious code when the screensaver activates.
Detects the addition of the 'Office test' registry key, specifically the 'Special\Perf' subkey, which allows an arbitrary DLL to be executed every time an Office application is started. This method is used for persistence.
This rule detects attempts to enumerate installed software versions on a Windows system using the `reg.exe` utility. Specifically, it looks for `reg.exe` commands that query the registry for software version information, often found under `HKEY_LOCAL_MACHINE\Software\` paths and requesting the `svcVersion` value. This activity can be indicative of an adversary trying to identify vulnerable software or understand the system's security posture.
This rule detects an unfixed User Account Control (UAC) bypass method in Windows 10 that leverages WSReset.exe. The bypass works by modifying a specific registry key associated with the Windows Store, allowing a low-privilege binary to be executed with elevated privileges when WSReset.exe is run.
Detects the execution of Microsoft Connection Manager Profile Installer (CMSTP.exe) by monitoring registry events where 'cmmgr32.exe' is the target object. This activity is often associated with defense evasion and execution techniques, as CMSTP can be abused to proxy execution of malicious code, bypass UAC, or load DLLs/COM scriptlets.
This rule detects the creation of a local hidden user account by monitoring Windows Registry events. Specifically, it looks for modifications within the 'SAM\SAM\Domains\Account\Users\Names\' registry path where the target object (the account name) ends with a '$' character, indicating a hidden account. The detection is further refined by ensuring the event is generated by 'lsass.exe', which is responsible for managing user accounts and authentication.
This rule detects modifications to the Windows Registry key associated with "TrustRecords" for Microsoft Office applications. These trust records are created when a user enables macros in a document, indicating that the document's source is trusted. Adversaries often leverage malicious macros in documents as an initial access vector. Monitoring changes to this registry path can help identify when macros are being enabled, potentially by a user interacting with a malicious document.
Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.
Detects handle requests and access operations to specific registry keys to calculate the SysKey
Detects value modification of registry key containing path to binary used as screensaver.
Alerts on trust record modification within the registry, indicating usage of macros
Detects Processes accessing the camera and microphone from suspicious folder
This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent.
This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent.
This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent.
This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS).
Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation).
This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent.
Make sure you set the SACL to propagate to its sub-keys.
Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation).
This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent.
Make sure you set the SACL to propagate to its sub-keys.
Potential adversaries accessing the microphone and webcam in an endpoint.
Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured.
Detects the use of Windows Credential Editor (WCE)
Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.
Page 52 of 53