Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
442 detections
Filters
Last updated
All Time
Detection languages
177
95
67
56
11
Contributors
86
58
55
51
21
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
441
8
3
3
1
Products / Services
144
116
86
36
21
MITRE Techniques
343
237
197
130
121
CVEs
3
2
1
1
1
IDS Classtypes
10
IDS Protocols
10
This rule detects attempts to bypass User Account Control (UAC) by monitoring modifications or creations of specific registry keys. Adversaries often manipulate these registry keys to achieve privilege escalation without triggering a UAC prompt, allowing them to execute malicious code with elevated permissions. The rule specifically looks for changes to registry paths commonly abused in UAC bypass techniques, such as those related to ms-settings, mscfile, Environment\UserInitMprLogonScript, exefile, Folder, and Image File Execution Options.
This rule detects attempts to modify the 'Run' key in the Windows Registry remotely over SMB (port 445). The 'Run' key is a common persistence mechanism used by attackers to ensure their malicious code executes every time a user logs in. The rule specifically looks for network traffic on port 445 containing the string 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run', indicating a potential remote registry modification related to startup programs.
MiniPlasma PoC Registry Artifacts
Cortex XDR
Detects the creation of specific registry keys in the .DEFAULT user hive associated with the MiniPlasma (CVE-2020-17103) proof-of-concept exploit. This exploit is a privilege escalation vulnerability.
Detects attempts to bypass User Account Control (UAC) by hijacking the execution flow of the auto-elevated fodhelper.exe binary via modifications to the ms-settings registry keys in the HKCU hive. Silent Stealer leverages this specific registry hijack to seamlessly gain elevated privileges without triggering user prompts, an essential step for its deep credential extraction processes.
Detects Atlas RAT anti-analysis behavior by monitoring for registry queries or interactions with the Windows Defender Application Guard (WDAG) RunOnce registry key. This rule specifically looks for registry events where the key name contains "RunOnce" and the value name contains "WDAG", indicating an attempt by malware to detect or interact with a sandbox environment.
Detects modification of the InprocServer32 key for the Windows Color System Calibration CLSID, used by Argamal RAT for persistence. Legitimate Windows Color System components are typically registered in HKLM, not HKCU.
Detects RunOnce registry modifications calling wscript.exe to execute an .icl script silently. This is indicative of GammaLoad malware establishing persistence.
Detects RunOnce registry modifications calling wscript.exe to execute an .icl script silently. This is indicative of GammaLoad malware establishing persistence.
Detects attempts to disable or tamper with PowerShell logging mechanisms (Script Block Logging, Module Logging, Transcription) by modifying or deleting specific registry keys or setting their values to disable logging. This activity is often performed by adversaries to evade detection.
Detects attempts to disable or tamper with PowerShell logging mechanisms (Script Block Logging, Module Logging, Transcription) by modifying or deleting specific registry keys or setting their values to disable logging. This activity is often performed by adversaries to evade detection.
Detects unexpected DACL modifications on critical policy keys (CloudFiles or System Policies). Relaxing these DACLs allows unprivileged actors to write values like DisableLockWorkstation, maintaining exploit persistence.
Detects scripts (Batch, PowerShell) that create a hidden local account (appended with $) and add it to highly privileged groups like Administrators and Remote Desktop Users.
Detects suspicious execution paths for svchost.exe, known malicious SHA256 hashes, or suspicious registry persistence mechanisms. Specifically, it looks for svchost.exe or a file named images.png executing from the 'Users\Public\Windows' directory, known malicious hashes, or a registry run key named 'Windows Update Service' under 'Software\Microsoft\Windows\CurrentVersion\Run'.
Detects the creation or modification of registry keys related to SyncRoots containing the hardcoded string 'SERIOUSLYMSFT', which is indicative of the RedSun exploit (CVE-2026-33825) abusing the Cloud Files API.
Detects registry modifications aimed at disabling critical Windows utilities (Task Manager, Registry Editor) or degrading the user interface (swapping mouse buttons, hiding desktop icons). These behaviors are indicative of the CrystalX 'Rofl' prankware and disruption module.
Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.
Detects "read access" requests on the services registry key.
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.
Detects specific registry modifications performed to turn off Windows Defender features such as Tamper Protection, Real-Time Monitoring, and AntiSpyware, or to modify the WinDefend service startup type. This rule identifies attempts to impair defensive capabilities on a Windows system.
Detects specific registry modifications performed to turn off Windows Defender features such as Tamper Protection, Real-Time Monitoring, and AntiSpyware, or to modify the WinDefend service startup type. This rule identifies attempts to impair defensive capabilities on a Windows system.
Detects network connections to malicious domains, associated IPs, execution of related malicious file hashes, registry persistence, and postinstall script executions related to UNC1069 NPM/Axios supply chain attacks deploying SILKBELL and WAVESHAPER.V2. Categorized into risk-scored scenarios.
Detects scripts modifying Windows registry run keys for establishing persistence
Page 11 of 22