Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61 detections
Filters
Last updated
All Time
Detection languages
32
18
6
2
1
Contributors
22
7
6
5
5
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
60
1
1
Products / Services
17
10
10
3
3
MITRE Techniques
39
23
14
13
11
IDS Classtypes
1
IDS Protocols
1
Detects the deletion of Chrome registry keys related to extension integrity verification. This behavior is often associated with browser-based attacks, such as malware or malicious extensions attempting to tamper with browser security configurations to enable persistent browser hijacking or unauthorized extension modification.
Detects rapid deletion of Windows Defender or WdFilter service registry keys by non-standard processes (not System or ntoskrnl.exe). This pattern is consistent with kernel-mode tamper protection bypass attempts, such as the use of the BTR.sys driver to force the removal of defensive configuration entries, effectively disabling Windows Defender.
Detects the execution of BTR_CLI.exe with cleanup parameters that correlate with the deletion of specific registry keys (services) and related file artifacts (e.g., .dat or changelist files) within a short time window. This pattern is indicative of a post-compromise cleanup routine aimed at removing traces of malicious services or payloads.
Detects the deletion of the Windows Application Event Log registry key. This action is a known technique used by adversaries to disable or tamper with event logging mechanisms to conceal malicious activity.
Detects the deletion of registry keys or values associated with Chrome extension settings by processes other than chrome.exe. This activity is often associated with the removal or tampering of browser extension configurations to maintain persistence, bypass security, or disable malicious extensions during an incident response or by an attacker.
Detects the deletion of registry keys or values associated with Chrome extension settings by processes other than chrome.exe. This activity is often associated with the removal or tampering of browser extension configurations to maintain persistence, bypass security, or disable malicious extensions during an incident response or by an attacker.
Detects the deletion of registry keys or values associated with Chrome extension settings by processes other than chrome.exe. This activity is often associated with the removal or tampering of browser extension configurations to maintain persistence, bypass security, or disable malicious extensions during an incident response or by an attacker.
Detects the deletion of registry keys or values associated with Google Chrome's extension settings preferences. This activity may indicate an attempt to disable installed extensions or tamper with browser security configurations.
Detects the deletion of registry keys associated with Windows SafeBoot configuration. Adversaries may delete these keys to disrupt system recovery mechanisms, preventing administrators from booting the system into Safe Mode to diagnose or remove malicious software.
Detects a malicious teardown sequence involving the 'drvsvc' service being stopped or deleted in the registry, followed by the deletion of the 'C:\Windows\System32\drivers\drv.sys' file within a 15-minute window. This behavior is indicative of a driver redeployment process, often associated with the removal of security-disabling components.
Detects deletion of persistence registry keys after successful execution
Detects modifications to Windows Registry keys associated with Event Tracing for Windows (ETW) Autologger configurations or Event Log service configurations. These modifications can be used by adversaries to disable or tamper with event logging mechanisms, effectively blinding security telemetry and evading detection.
Detects modifications to Windows Registry keys associated with Event Tracing for Windows (ETW) Autologger configurations or Event Log service configurations. These modifications can be used by adversaries to disable or tamper with event logging mechanisms, effectively blinding security telemetry and evading detection.
Detects creation or modification of SilverFox/Sauron campaign-specific registry keys (Software\ODBDC, SOFTWARE\JDBCC, SOFTWARE\Sauron) and the 'revbs' value name used as infection state tracking markers.
This rule detects scripts that load a driver and subsequently attempt to remove its associated service and source artifacts. It specifically looks for the presence of 'NtLoadDriver' API calls, 'sc delete' commands for service removal, 'reg delete' commands for registry cleanup, and references to specific filenames like 'fsdiskbit.sys' and 'msidiskserver', which are associated with the Sprysocks malware.
This rule correlates the creation and subsequent removal of a driver service within a 15-minute window. It specifically looks for registry events indicating the creation and deletion of a service key, where the service's image path ends with '.sys' or the key name contains 'msidiskserver'. This behavior is indicative of the transient driver-loading workflow used by SprySOCKS malware.
This rule detects network traffic indicating the deletion of a persistence registry key, specifically 'CurrentVersion\\Run', after an execution. It looks for TCP traffic to the home network on port 445 (SMB) containing both 'CurrentVersion\\Run' and 'RegDeleteKey' (case-insensitive). This behavior is often associated with malware attempting to clean up its persistence mechanisms to evade detection.
Detects attempts to disable or tamper with PowerShell logging mechanisms (Script Block Logging, Module Logging, Transcription) by modifying or deleting specific registry keys or setting their values to disable logging. This activity is often performed by adversaries to evade detection.
Detects attempts to disable or tamper with PowerShell logging mechanisms (Script Block Logging, Module Logging, Transcription) by modifying or deleting specific registry keys or setting their values to disable logging. This activity is often performed by adversaries to evade detection.
Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection.
Detects any deletion of entries in ".*\shell\open\command" registry keys.
These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.
These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.
Page 1 of 3