Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
214 detections
Filters
Last updated
All Time
Detection languages
133
44
18
7
6
Contributors
49
33
31
20
13
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
212
1
1
Products / Services
106
48
19
18
4
MITRE Techniques
185
88
77
63
48
CVEs
5
5
4
1
1
IDS Classtypes
1
IDS Protocols
1
Detects remote support software being added to common user or machine Run and RunOnce registry persistence locations. This rule specifically looks for modifications or creations within the 'Run' and 'RunOnce' registry keys that contain strings associated with known remote access or management tools such as AnyDesk, Bomgar, BeyondTrust, Zoho, ScreenConnect, Splashtop, Atera, SuperOps, and TeamViewer. This activity could indicate an attacker establishing persistence on a compromised system.
This rule detects installation artifacts, configuration file modifications, registry changes, and network activity associated with a specific malicious Chromium extension ('flkebkiofojicogddingbdmcmkpbplcd') that hijacks the default browser search provider via declarativeNetRequest rules and communicates with a typosquatted domain 'perplexity-ai.online'.
Detects the creation or modification of Windows Registry keys within the 'CurrentVersion\Run' path, a common technique used by adversaries to achieve persistence by ensuring arbitrary programs execute upon user logon.
Detects the creation or modification of Windows Registry keys within the 'CurrentVersion\Run' path, a common technique used by adversaries to achieve persistence by ensuring arbitrary programs execute upon user logon.
Detects the creation or modification of registry keys in HKEY_CURRENT_USER\Run, targeting registry values related to remote access applications like AnyDesk, Splashtop, or Comms. The rule specifically looks for evidence that these entries are configured to execute Python interpreter executables (e.g., pythonw.exe or WPy64), which can indicate an attempt to maintain persistence using authorized software or masqueraded scripts.
Detects various indicators associated with the SilverFox loader deploying the Sauron RAT, including registry markers, service creation, self-copying of svchost.exe, specific marker file artifacts, and known C2 communication.
Detects indicators of the SNOWLIGHT dropper establishing persistence by either creating a malicious Windows service named 'wusvc', modifying the Windows registry to add a service entry for 'wusvc', or executing a 'wusvc.exe' binary from a non-standard file path (outside of System32 or SysWOW64).
Detects potential persistence attempts by the SNOWLIGHT dropper, which masquerades as the legitimate Windows Update service (wusvc). The rule monitors for unauthorized execution of wusvc.exe, the use of sc.exe to register a wusvc service, and direct modification of registry keys associated with the wusvc service path.
This rule detects modifications to specific Windows Registry keys used for keyboard layout remapping ('Scancode Map') or mouse button swapping ('SwapMouseButtons'). Such modifications can be used by adversaries to facilitate keylogging, persistent input redirection, or to impair user interaction. The rule prioritizes alerts where the change was initiated by script engines like wscript.exe or cscript.exe, which are common vectors for VBScript-based malware.
This rule detects potential persistence and execution of suspicious VBScript files ('Telegram_Private_Call_Session.vbs' or 'assurance.vbs'). It monitors for the creation or modification of these files within the Windows Startup folder, their execution via wscript.exe, and the creation of corresponding registry entries to ensure automatic startup.
Detects the execution of the PsExec service (PSEXESVC) or command-line usage indicating remote service execution, including the standard PsExec '-accepteula' flag combined with network path indicators. Additionally detects the creation of the PSEXESVC service registry key, which is indicative of PsExec-based lateral movement or remote administration.
Detects the installation of the integralXk3 registry RunOnce persistence key, a persistent signature of GammaLoad, which is associated with the Gamaredon APT group.
This rule correlates the creation and subsequent removal of a driver service within a 15-minute window. It specifically looks for registry events indicating the creation and deletion of a service key, where the service's image path ends with '.sys' or the key name contains 'msidiskserver'. This behavior is indicative of the transient driver-loading workflow used by SprySOCKS malware.
Detects creation of new Windows services for persistence
Detects creation of new Windows services for persistence
Detects installation of root certificates to enable MITM interception
Detects modification of macOS login hook scripts for persistence
Detects modification of registry keys that trigger event-based execution for persistence
Detects post-reboot persistence mechanism established by the Mustang Panda PlugX variant, utilizing a 'G Data' Run key and a suspicious staging path pointing to 'Avk.exe'. This rule specifically looks for registry key creations or value sets in the Run key where the value name is 'G Data' or the value data contains 'GData\Avk.exe'.
Detects the creation or modification of a registry run key that masquerades as 'WindowsUpdate' and points to an executable within a 'Temp' directory with a specific naming pattern (e.g., 'winupd_[a-z0-9]+.exe'). This technique is commonly used by adversaries to establish persistence on a system by ensuring their malicious payload executes upon user login.
Detects the creation or modification of a registry run key that masquerades as 'WindowsUpdate' and points to an executable within a 'Temp' directory with a specific naming pattern (e.g., 'winupd_[a-z0-9]+.exe'). This technique is commonly used by adversaries to establish persistence on a system by ensuring their malicious payload executes upon user login.
Page 7 of 11