Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
214 detections
Filters
Last updated
All Time
Detection languages
133
44
18
7
6
Contributors
49
33
31
20
13
Categories
20,407
11,798
5,867
5,145
4,864
Platforms
212
1
1
Products / Services
106
48
19
18
4
MITRE Techniques
185
88
77
63
48
CVEs
5
5
4
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the installation, service creation, and network activity associated with Tailscale VPN on endpoints. The rule monitors for process creation of Tailscale binaries, creation of associated registry keys, and outbound network traffic to Tailscale infrastructure or the internal 100.64.0.0/10 CGNAT mesh range, which may indicate unauthorized persistence or remote access.
Detects the creation or modification of registry keys in HKEY_CURRENT_USER\Run, targeting registry values related to remote access applications like AnyDesk, Splashtop, or Comms. The rule specifically looks for evidence that these entries are configured to execute Python interpreter executables (e.g., pythonw.exe or WPy64), which can indicate an attempt to maintain persistence using authorized software or masqueraded scripts.
Detects modifications to the Windows Registry keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network. These keys control which services or drivers are permitted to load during Safe Mode with Networking. Unauthorized changes to these keys can be used to ensure malicious drivers or services load during Safe Mode, providing a persistence mechanism that bypasses many security controls.
Detects the installation or presence of a specific malicious Chromium browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd) associated with Perplexity AI-themed phishing or malicious activity. The rule monitors file system events, process command lines, and registry modifications related to the Chrome Extensions directory.
Detects the installation of the NexShield malicious Chrome extension, which impersonates uBlock Origin Lite. The rule monitors for the creation or modification of 'manifest.json' files within Chrome extension directories and registry key activity related to the extension's installation, specifically flagging references to 'NexShield' or deceptive 'uBlock Origin Lite' naming conventions.
Detects the creation or modification of Windows Registry Run keys (Run/RunOnce) by processes other than those signed by Microsoft Corporation. This is a common technique used to maintain persistence by executing programs automatically upon user logon.
Detects registry modifications (specifically key creation or value setting) initiated by QEMU system binaries or their child processes, focusing on paths commonly associated with persistence (Run keys) or general software configuration storage.
Detects modifications or creation of 'InprocServer32' registry keys within 'HKEY_CURRENT_USER\Software\Classes\CLSID'. This pattern is frequently used for COM hijacking to achieve persistence or execute arbitrary code when a COM object is invoked by an application or the OS.
Detects modifications or creation of 'InprocServer32' registry keys within 'HKEY_CURRENT_USER\Software\Classes\CLSID'. This pattern is frequently used for COM hijacking to achieve persistence or execute arbitrary code when a COM object is invoked by an application or the OS.
Detects the creation or modification of a registry run key named 'MsEdgeUpdate' that points to an executable named 'svchost.exe' located within an 'AppData' directory. This behavior is highly suspicious as it mimics a legitimate Microsoft Edge update process to achieve persistence while running an arbitrary executable from a user-writable path.
Detects the creation or modification of Windows Registry keys or values within the 'CurrentControlSet\Services' path that refer to 'rustdesk'. This typically indicates the installation or configuration of the RustDesk remote access tool as a system service, which may be unauthorized or used for persistence by an adversary.
Detects potential sideloading of malicious Chrome extensions by monitoring for unauthorized file creation of 'manifest.json' files within the browser's extension directories and unauthorized registry modifications related to extension management. The rule specifically excludes legitimate processes like 'chrome.exe' and 'GoogleUpdate.exe', aiming to identify third-party processes attempting to register or install browser extensions.
Detects the registration of a Cloud Files sync root provider with the name 'SERIOUSLYMSFT', a hardcoded value in the RedSun exploit (CVE-2026-41091).
Detects GreenBlood ransomware attempting to establish persistence by creating a new Windows service. This rule identifies suspicious 'sc.exe' commands that include 'green' or 'blood' in the service name, or 'sc.exe' commands creating services from common temporary/application data paths. It also looks for direct registry modifications to the Services key with 'green' or 'blood' in the key name.
Detects the registration of a Cloud Files sync root provider with the name 'SERIOUSLYMSFT', a hardcoded value used by the RedSun exploit (CVE-2026-41091). This activity indicates an attempt to establish persistence or execute malicious code by abusing the Windows SyncRootManager functionality.
Detects modifications to the 'Software\Classes\ms-settings\shell\open\command' registry key, a technique commonly used to bypass User Account Control (UAC). By setting the default handler for the ms-settings protocol to a malicious command, an attacker can achieve elevated execution when the protocol is triggered by a legitimate Windows component.
Detects modifications to the 'Software\Classes\ms-settings\shell\open\command' registry key, a technique commonly used to bypass User Account Control (UAC). By setting the default handler for the ms-settings protocol to a malicious command, an attacker can achieve elevated execution when the protocol is triggered by a legitimate Windows component.
Detects the creation or modification of Windows Registry Run keys (Run/RunOnce) by processes other than those signed by Microsoft Corporation. This is a common technique used to maintain persistence by executing programs automatically upon user logon.
This rule detects the creation or modification of a COM object registry key under HKEY_CURRENT_USER\Software\Classes\CLSID\ with an 'InProcServer32' subkey. This is a common technique used by adversaries for persistence and privilege escalation by hijacking COM object references to execute arbitrary malicious code when the legitimate application attempts to use the hijacked COM object.
This rule detects the creation or modification of a COM object registry key under HKEY_CURRENT_USER\Software\Classes\CLSID\ with an 'InProcServer32' subkey. This is a common technique used by adversaries for persistence and privilege escalation by hijacking COM object references to execute arbitrary malicious code when the legitimate application attempts to use the hijacked COM object.
Detects the creation or modification of HKCU Registry Run keys where the value name mimics legitimate remote access software (AnyDesk, Splashtop, or Comms). This behavior is associated with the Woodgnat (KongTuke) threat actor to establish persistence by masking malicious autostart entries as common administrative tools.
Page 5 of 11