Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
214 detections
Filters
Last updated
All Time
Detection languages
133
44
18
7
6
Contributors
49
33
31
20
13
Categories
20,407
11,798
5,867
5,145
4,864
Platforms
212
1
1
Products / Services
106
48
19
18
4
MITRE Techniques
185
88
77
63
48
CVEs
5
5
4
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the execution of a Sysinternals Tool via the creation of the "EulaAccepted" registry key. Many Sysinternals tools create this key upon first execution to signify acceptance of the End User License Agreement (EULA). This can be an indicator of Sysinternals tools being used on a system, which are often leveraged by adversaries for various post-exploitation activities.
Detects the creation of the "accepteula" registry key by Sysinternals tools that have been renamed. This behavior is suspicious because legitimate Sysinternals tools typically create this key with their original executable names. Adversaries often rename tools to evade detection, and this rule specifically looks for instances where the EULA acceptance key is created by an executable whose name does not match the expected Sysinternals tool name.
Detects when an attacker registers a new AMSI provider in the Windows Registry to establish persistence. This technique involves creating or modifying registry keys under `SOFTWARE\Microsoft\AMSI\Providers\` or `SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\` to load a malicious DLL when AMSI is initialized. The rule filters out legitimate system processes that might perform similar actions from standard Windows and Program Files directories.
This YARA rule detects the Zoldon ransomware by identifying specific byte patterns associated with its core functionalities. These patterns include sequences related to the main encryption function, the creation of a specific registry key (likely for persistence or configuration), and functions involved in finding files to encrypt. The rule looks for these distinct code segments within executable files.
Page 11 of 11