Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
214 detections
Filters
Last updated
All Time
Detection languages
133
44
18
7
6
Contributors
49
33
31
20
13
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
212
1
1
Products / Services
106
48
19
18
4
MITRE Techniques
185
88
77
63
48
CVEs
5
5
4
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the modification or creation of the 'SealedConfig' value within the 'Software\synapse\Config' registry key, correlated with the deletion of a 'config.toml' file on the same device. This pattern may indicate an adversary tampering with Synapse software configuration or attempting to remove audit/configuration trails.
This rule detects modifications to Windows Registry persistence keys (Run and RunOnce) associated with specific suspicious filenames ('cplsupport.exe', 'wtass.exe'), as well as modifications to specific Synapse agent configuration registry keys. These patterns are often associated with persistence mechanisms or unauthorized software configuration changes.
Detects modifications or creation of InprocServer32 COM registry keys by suspicious processes like mshta.exe or powershell.exe, which is indicative of COM Hijacking for persistence or privilege escalation.
Detects the modification or creation of the 'SealedConfig' value within the 'Software\synapse\Config' registry key, correlated with the deletion of a 'config.toml' file on the same device. This pattern may indicate an adversary tampering with Synapse software configuration or attempting to remove audit/configuration trails.
Detects the creation of an NTUSER.MAN file followed by an update or creation of a registry run key (Run or RunOnce) on the same device within a 60-minute window. NTUSER.MAN is a mandatory user profile file that, when present, can be used to override user settings and persist malicious configurations or startup entries.
This rule detects the creation or modification of the 'goopdate' registry value under the HKCU\Software\Microsoft\Windows\CurrentVersion\Run path. This technique is used to achieve persistence by executing specified files (e.g., Sang.exe or defender.exe with the 'work' parameter) upon user logon.
This rule detects the creation or modification of the 'goopdate' registry value under the HKCU\Software\Microsoft\Windows\CurrentVersion\Run path. This technique is used to achieve persistence by executing specified files (e.g., Sang.exe or defender.exe with the 'work' parameter) upon user logon.
Detects unauthorized modifications to the SAM registry hive (specifically keys and values related to user account RIDs) by non-system processes, which is a technique used in RID hijacking to grant elevated privileges or create hidden accounts.
Detects signs of Cloudflared tunnel persistence on Windows endpoints, specifically targeting service registration (via sc.exe or registry modifications) and the presence of the cloudflared.exe binary. This is often used by attackers to maintain outbound-only access to compromised machines following exploitation of vulnerabilities like CVE-2026-18577.
This rule detects potential persistence or privilege escalation attempts using Windows Print Monitors. It identifies two specific behaviors: the registry modification of the Print Monitors key to load a DLL from a non-standard, user-writable directory (e.g., ProgramData or Users) which is subsequently loaded by the print spooler service (spoolsv.exe), and suspicious registry activity occurring immediately prior to such modifications, specifically involving non-system accounts or vendor-specific services writing to HKLM registry paths.
This rule detects potential persistence or privilege escalation attempts using Windows Print Monitors. It identifies two specific behaviors: the registry modification of the Print Monitors key to load a DLL from a non-standard, user-writable directory (e.g., ProgramData or Users) which is subsequently loaded by the print spooler service (spoolsv.exe), and suspicious registry activity occurring immediately prior to such modifications, specifically involving non-system accounts or vendor-specific services writing to HKLM registry paths.
This query helps to identify service creation events regardless of the tool/method used for service creation (even if the threat actors use the Windows API directly, without leaving any command line traces).
Detects evidence of the TELEPUZ malware establishing persistence by installing a Windows service named 'CipherAllocator' or 'PilotmasterMast'. The rule monitors for the installation of these specific services via Windows Event ID 7045, process command line execution, and direct registry key modifications.
This rule detects modifications or creation of registry values within the Windows 'Run' keys that specifically match known malicious persistence mechanism identifiers, such as 'MediumNetMonIt' or 'ZohoUsingUpdataAnyssAll_RunOnece'. These registry keys are frequently used by attackers to ensure malicious code executes automatically upon system boot or user logon.
Detects modifications or creations of Image File Execution Options (IFEO) registry keys where a 'Debugger' value is set. IFEO is a feature that allows a debugger to be attached to an executable, which is often abused by attackers for persistence, privilege escalation, or defense evasion by executing malicious code when the target application launches.
This rule detects the registration of the 'CipherAllocator' Windows service associated with the TELEPUZ malware. It monitors registry modifications related to service creation, specifically identifying the usage of 'grpeng.dll' from a suspicious path ('C:\ProgramData\XeroxPrint\Temp\Worker\') and specific 'svchost' registry configurations used for persistence.
Detects the creation or modification of Registry keys and values associated with Image File Execution Options (IFEO). Adversaries commonly abuse IFEO for persistence, privilege escalation, or to hijack process execution by attaching malicious debuggers to legitimate system binaries, such as MsMpEng.exe, or by creating temp hive mounts.
This rule detects a multi-stage attack chain associated with the SnappyClient RAT (Operation Turb00). The detection logic correlates: 1. Execution of known malicious processes (AlphVector, WizardDa42, VirtualAr, or Crisp); 2. Persistence mechanisms including specific registry keys (CadenceOptimizer) or file artifacts (shortcut links, scheduled tasks, Mayanex data dir, or CorsairUtil DLL); and 3. Outbound network traffic on ports 3333 or 3334 to external IP addresses.
Detects the creation or modification of Windows Registry Run keys or the addition of files into the startup directory. These are common persistence mechanisms used by adversaries to ensure programs execute automatically upon system boot or user logon.
This rule detects various Windows persistence and hijacking techniques by monitoring registry activity. Specifically, it identifies the manipulation of IFEO (Image File Execution Options) Debugger or GlobalFlag keys, HKCU COM class hijacking through InProcServer32 or LocalServer32, and the AppCertDlls registry value, which can be used to inject malicious code into processes.
This rule detects potential persistence mechanisms on Windows systems by monitoring for the creation or modification of registry run keys, the use of 'reg.exe' to add entries to run keys, and the creation of shortcut files (.lnk) in the Windows Startup directory.
Page 4 of 11