Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
214 detections
Filters
Last updated
All Time
Detection languages
133
44
18
7
6
Contributors
49
33
31
20
13
Categories
20,407
11,798
5,867
5,145
4,864
Platforms
212
1
1
Products / Services
106
48
19
18
4
MITRE Techniques
185
88
77
63
48
CVEs
5
5
4
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the registration of a Cloud Files sync root provider with the name 'SERIOUSLYMSFT', a hardcoded value used by the RedSun exploit (CVE-2026-41091). This activity indicates an attempt to establish persistence or execute malicious code by abusing the Windows SyncRootManager functionality.
MiniPlasma Registry Modification
Cortex XDR
This rule detects attempts to create or modify registry keys or values within the '.DEFAULT\Volatile Environment' path or 'Software\Policies\Microsoft\CloudFiles\BlockedApps'. Modifications to these keys can be indicator of the MiniPlasma privilege escalation technique
Detects the creation or modification of a registry run key that masquerades as 'WindowsUpdate' and points to an executable within a 'Temp' directory with a specific naming pattern (e.g., 'winupd_[a-z0-9]+.exe'). This technique is commonly used by adversaries to establish persistence on a system by ensuring their malicious payload executes upon user login.
This rule detects attempts to bypass User Account Control (UAC) by monitoring modifications or creations of specific registry keys. Adversaries often manipulate these registry keys to achieve privilege escalation without triggering a UAC prompt, allowing them to execute malicious code with elevated permissions. The rule specifically looks for changes to registry paths commonly abused in UAC bypass techniques, such as those related to ms-settings, mscfile, Environment\UserInitMprLogonScript, exefile, Folder, and Image File Execution Options.
MiniPlasma PoC Registry Artifacts
Cortex XDR
Detects the creation of specific registry keys in the .DEFAULT user hive associated with the MiniPlasma (CVE-2020-17103) proof-of-concept exploit. This exploit is a privilege escalation vulnerability.
Detects the creation or modification of registry run keys associated with the BoldTealLayer persistence mechanism, specifically targeting 'BoldTealLayer150'.
Detects the registration of the PLURIBUS Cloud Files sync provider used by the CVE-2023-36036 (cldflt.sys heap overflow) privilege escalation exploit in the Rapid7-documented ModeloRAT incident. The exploit registers a fake sync provider with the specific GUID {904EE598-0511-4664-82A8-22C4A7501044} pointing to %TEMP%\cldflt\, then writes a placeholder file (Link.log) to trigger the vulnerable code path. The provider GUID, name, and registry path are all unique to this exploit variant — legitimate sync providers (OneDrive, Dropbox, Box) use vendor-specific GUIDs and never register under %TEMP%.
CloudFiles BlockedApps Registry Symlink
Cortex XDR
Detects registry key creation under CloudFiles\BlockedApps, indicative of the GreenPlasma exploit where attackers use a volatile registry symlink to hijack the CloudFiles policy engine. This technique can be used for privilege escalation.
Detects creation or modification of the SafeBoot\Network\Remote Access Service registry key, a persistence mechanism used by the STAC6405 (VENOMOUS#HELPER) campaign. This ensures the SimpleHelp-based RAT survives Safe Mode with Networking reboots, which is a common remediation step for defenders. The specific 'Remote Access Service' subkey under SafeBoot\Network is a static Indicator of Compromise (IOC) for this campaign, as modifications to SafeBoot\Network are generally rare in benign Windows operations.
Detects the creation or modification of registry keys related to SyncRoots containing the hardcoded string 'SERIOUSLYMSFT', which is indicative of the RedSun exploit (CVE-2026-33825) abusing the Cloud Files API.
Detects the creation of a registry key used by the BlackBeard backdoor for persistence. The malware associates a custom file extension (.wdlp) with a malicious script (WebDeepPlayer.scr) to ensure it is executed on user logon.
Detects behaviors associated with the GRIDTIDE backdoor, including a specific self-deletion technique using 'ping 127.0.0.1 && del' and the creation of unique mutexes. These indicators are highly specific to the GRIDTIDE threat.
This rule detects attempts to bypass User Account Control (UAC) by monitoring modifications or creations of specific registry keys. Adversaries often manipulate these registry keys to achieve privilege escalation without triggering a UAC prompt, allowing them to execute malicious code with elevated permissions. The rule specifically looks for changes to registry paths commonly abused in UAC bypass techniques, such as those related to ms-settings, mscfile, Environment\UserInitMprLogonScript, exefile, Folder, and Image File Execution Options.
This rule detects the creation of a registry key named 'MonitoringService' under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'. This registry key is commonly used by adversaries to establish persistence, ensuring that a malicious program or script executes automatically each time a user logs on to the system.
Detects the creation of a new Microsoft Office Trusted Location via registry modification. Attackers abuse this feature to add a location they control, allowing macros or other active content to run without security warnings, bypassing Mark-of-the-Web (MotW) protections.
Detects a script process (wscript.exe/cscript.exe) creating files in a specific HP-themed path and then creating a Run key for persistence, indicative of the Turla Kazuar VBScript dropper.
Detects modifications to Windows Registry keys related to Remote Desktop Protocol (RDP) configuration. Malware like DarkGate is known to manipulate these settings to enable or modify RDP for persistence and remote access.
This use case is meant to identify Run registry key modifications which point to a file located within the "C:\Users\Public" folder.
Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence.
The disk cleanup manager is part of the operating system. It displays the dialog box […]
The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI.
Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications.
Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler.
Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.
The disk cleanup manager is part of the operating system. It displays the dialog box […]
The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI.
Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications.
Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler.
Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.
This rule detects the creation of executable files (.exe, .dll, .pyd) within browser extension folders (Chrome, Edge, Firefox) followed by a related registry modification within a one-hour window. This behavior is indicative of malicious browser extension installation or modification, often used for persistence or data exfiltration.
This rule detects the creation of registry keys associated with NetWire RAT. Specifically, it looks for the creation of a registry key containing '\software\NetWire' in its path, which is a known location where NetWire RAT stores its configuration information.
Page 8 of 11