Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
214 detections
Filters
Last updated
All Time
Detection languages
133
44
18
7
6
Contributors
49
33
31
20
13
Categories
20,407
11,798
5,867
5,145
4,864
Platforms
212
1
1
Products / Services
106
48
19
18
4
MITRE Techniques
185
88
77
63
48
CVEs
5
5
4
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the execution of the PsExec service (PSEXESVC) or command-line usage indicating remote service execution, including the standard PsExec '-accepteula' flag combined with network path indicators. Additionally detects the creation of the PSEXESVC service registry key, which is indicative of PsExec-based lateral movement or remote administration.
Detects potential persistence attempts by TrymeLocker malware, specifically monitoring for malicious StubPath values written to Active Setup registry keys. The rule correlates this behavior with other indicators of compromise such as malicious Debugger values set within Image File Execution Options (IFEO) keys or suspicious service creation, effectively identifying high-confidence persistence activity.
Detects the creation or modification of a registry run key under the 'Run' hive where the target executable is located within a GUID-named subdirectory inside the user's AppData/Local folder. This pattern is commonly used by malicious software to maintain persistence by masquerading as a legitimate browser or application process.
Detects the creation or modification of Windows Registry keys or values within the 'CurrentControlSet\Services' path that refer to 'rustdesk'. This typically indicates the installation or configuration of the RustDesk remote access tool as a system service, which may be unauthorized or used for persistence by an adversary.
Detects registry key creation under the Windows SyncRootManager path (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager) initiated by a process that is not a known legitimate cloud sync client. This technique is associated with CVE-2026-41091 (RedSun) for privilege escalation via Cloud Files sync root provider registration.
This rule detects attempts to establish persistence by modifying Registry Run keys or creating files in Startup folders, specifically when the initiating process is 'explorer.exe'. This behavior is often associated with malware injecting into explorer.exe to maintain persistence.
Detects the creation or modification of Windows services related to 'MixedSvc' or 'MixedRealitySvc' registry keys performed by non-standard processes. The rule specifically flags registry keys that point to suspicious directories such as AppData, Temp, ProgramData, or Windows Media Player, which is indicative of persistence mechanisms used by malware like DcRAT.
Detects registry key creation under the Windows SyncRootManager path (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager) initiated by a process that is not a known legitimate cloud sync client. This technique is associated with CVE-2026-41091 (RedSun) for privilege escalation via Cloud Files sync root provider registration.
Detects the creation or modification of a Registry Run key value named 'csshost'. This technique is commonly used by malware or persistent threats to achieve automatic execution upon system logon or boot by masquerading as or hijacking a host-related entry.
Detects the creation or modification of a Registry Run key value named 'csshost'. This technique is commonly used by malware or persistent threats to achieve automatic execution upon system logon or boot by masquerading as or hijacking a host-related entry.
Detects activity associated with the StegoAd browser extension campaign. This rule monitors for the registration of new browser extensions in Chrome or Edge, followed by suspicious browser-based network activity including DNS queries to known C2 infrastructure or the loading of specific WebP files used for steganographic payload delivery.
Detects enumeration or modification of the AppModelUnlock registry key, specifically 'AllowDevelopmentWithoutDevLicense' or 'IsDeveloperModeEnabled', which are prerequisites for enabling Developer Mode. This activity is relevant to the UNCanny coercion primitive, which leverages loose-file UNC AppX package registration.
Detects the creation or modification of Windows Registry Run keys that point to potential Node.js applications or scripts. This is a common persistence technique where attackers configure malicious scripts to execute upon user logon or system startup.
Detects modifications to the Windows Registry keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network. These keys control which services or drivers are permitted to load during Safe Mode with Networking. Unauthorized changes to these keys can be used to ensure malicious drivers or services load during Safe Mode, providing a persistence mechanism that bypasses many security controls.
Detects potential persistence or configuration activity associated with the Remcos Remote Access Trojan (RAT). The rule monitors for the creation or modification of registry keys explicitly named 'Remcos', as well as the addition of executables from suspicious paths (e.g., AppData, Temp) to the Windows 'Run' registry keys, a common technique for achieving persistence.
Detects potential persistence or configuration activity associated with the Remcos Remote Access Trojan (RAT). The rule monitors for the creation or modification of registry keys explicitly named 'Remcos', as well as the addition of executables from suspicious paths (e.g., AppData, Temp) to the Windows 'Run' registry keys, a common technique for achieving persistence.
Detects modifications to Windows Active Setup registry keys involving suspicious StubPath values or the creation of the specific {RAGE-MASTER} registry key associated with TrymeLocker malware. This technique is used to maintain persistence by executing malicious code upon user login.
Detects creation or modification of SilverFox/Sauron campaign-specific registry keys (Software\ODBDC, SOFTWARE\JDBCC, SOFTWARE\Sauron) and the 'revbs' value name used as infection state tracking markers.
This rule detects various activities associated with the Remcos Remote Access Trojan (RAT). It identifies the execution of JavaScript payloads (potentially MonoGlyphRAT) via script hosts (wscript.exe, cscript.exe), direct execution of 'remcos.exe', 'cmd.exe /c' spawned by 'remcos.exe' indicating C2 shell activity, and the creation of registry keys for Remcos persistence.
Detects suspicious registry writes to HKLM StaticPluginMap or HKCU CLSID entries that could be used to redirect InstallService plugin loading. Adversaries may modify these registry keys to achieve persistence or defense evasion by hijacking the loading of legitimate plugins.
Detects User Account Control (UAC) bypass attempts where a registry key (e.g., ms-settings, mscfile, or Folder shell open command) is created or modified in HKCU, followed within 2 minutes by the execution of an elevated child process (High or System integrity level) by known auto-elevating binaries: fodhelper.exe, computerdefaults.exe, or eventvwr.exe.
Page 6 of 11