Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
214 detections
Filters
Last updated
All Time
Detection languages
133
44
18
7
6
Contributors
49
33
31
20
13
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
212
1
1
Products / Services
106
48
19
18
4
MITRE Techniques
185
88
77
63
48
CVEs
5
5
4
1
1
IDS Classtypes
1
IDS Protocols
1
This rule detects the creation of specific registry keys under 'Software\AppDataLow\Software\Microsoft\' that are known to be associated with Ursnif malware. The rule filters out common legitimate registry paths used by Internet Explorer, RepService, IME, and Edge to reduce false positives.
This rule detects the creation or modification of specific registry keys that have been observed in attacks attributed to the OceanLotus (also known as APT32) threat group. The rule specifically looks for patterns in `TargetObject` paths related to CLSID entries and `AppX` entries within `HKCU\SOFTWARE\Classes` and `HKCU\SOFTWARE\App`.
Detects the creation of the 'UserInitMprLogonScript' registry value, which can be leveraged by adversaries to establish persistence on a system. This registry key is designed to execute a script upon user logon, making it a valuable target for malicious actors seeking to maintain access.
Detects potential COM object hijacking attempts by monitoring the creation of 'TreatAs' subkeys within the HKU (HKEY_USERS) hive. Adversaries can manipulate the Windows Component Object Model (COM) registry structure to redirect legitimate COM object calls to malicious code, achieving persistence or privilege escalation. This rule specifically looks for the creation of a 'TreatAs' subkey under a CLSID (Class ID) entry, which is a known method for COM hijacking. The rule filters out creations by 'svchost.exe' to reduce false positives, as svchost can legitimately create such keys.
Detects attempts to disable security event logging by adding the `MiniNt` registry key. This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications. Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.
This rule detects the creation or modification of the 'MiniNt' registry key under 'HKLM\SYSTEM\CurrentControlSet\Control\'. The presence of this key, particularly after a system reboot, can prevent the Windows Event Log service from writing events, effectively disabling security event logging. This is a known technique used by adversaries for defense evasion.
This analytic detects the addition of new InProcServer32 registry keys on Windows endpoints. Malware often uses this mechanism to achieve persistence or execute malicious code by registering a new InProcServer32 key pointing to a harmful DLL. If confirmed malicious, this could allow an attacker to persist in the environment or execute arbitrary code, posing a significant threat to system integrity and security.
This rule detects the creation or modification of registry keys and values under "HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Personal". This activity can indicate unauthorized personal OneDrive usage within an organization, which could be leveraged for data exfiltration, establishing persistence through cloud sync, or user profile manipulation. It is particularly useful for identifying insider threats, compromised servers, or automated exfiltration scripts.
This detection identifies the creation of registry keys under HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers\, which occur when a user initiates a Remote Desktop Protocol (RDP) connection using the built-in Windows RDP client (mstsc.exe). These registry entries store information about previously connected remote hosts, including usernames and display settings. Their creation is a strong indicator that an outbound RDP session was initiated from the system. While the presence of these keys is normal during legitimate RDP use, their appearance can be used to track remote access activity, especially in environments where RDP is tightly controlled. In post-compromise scenarios, these artifacts may be created by threat actors using RDP for lateral movement or command-and-control. Monitoring the creation of these registry entries can help defenders detect initial use of RDP from a compromised host, particularly when correlated with unusual user behavior, logon patterns, or network activity.
This analytic detects the presence of a registry key associated with the Remcos RAT agent on a host. It leverages data from the Endpoint.Registry data model, focusing on instances where the "Software\Remcos" path is found. This behavior indicates potential compromise by the Remcos RAT, a remote access Trojan used for unauthorized access and data exfiltration. If confirmed malicious, the attacker could gain control over the system, steal sensitive information, or use the compromised host for further attacks. Immediate investigation and remediation are required.
This detection identifies attempts to establish persistence by modifying known Windows startup registry keys. These keys control which programs are automatically executed during system boot or user logon and are frequently abused by adversaries to maintain access across reboots.
Analysts will need to tune the rule through testing and using the exclusion statements to remove noise of what is known good within their environments.
Analysts will need to tune the rule through testing and using the exclusion statements to remove noise of what is known good within their environments.
KQL Query
KQL Query from file: BadSuccessor Detection
KQL Query
KQL Query from file: Seashell Blizzard (IRIDIUM) - PWS:Win64-HighCount
KQL Query
Detects registry keys related to NetWire RAT
Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors
Detects COM object hijacking via TreatAs subkey
Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors
Detects registry keys related to NetWire RAT
Page 9 of 11