Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
442 detections
Filters
Last updated
All Time
Detection languages
177
95
67
56
11
Contributors
86
58
55
51
21
Categories
20,424
11,812
5,870
5,145
4,864
Platforms
441
8
3
3
1
Products / Services
144
116
86
36
21
MITRE Techniques
343
237
197
130
121
CVEs
3
2
1
1
1
IDS Classtypes
10
IDS Protocols
10
Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob matching a pattern indicative of a marshaled CREDENTIAL_TARGET_INFORMATION structure. This pattern is commonly used in Kerberos coercion attacks where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests, such as in CVE-2025-33073. Investigation should focus on the user account making the changes, as it is likely a compromised low-privileged account.
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. This can be used by adversaries for persistence, privilege escalation, or defense evasion.
Detects the modification of specific CLSID registry keys related to the .NET NGEN scheduled task. This Component Object Model (COM) hijacking technique is used by the threat actor 'Curly COMrades' to establish persistence for their 'MucorAgent' backdoor.
Detects the installation of new shim databases that attempt to patch sections of known processes for potential process injection or persistence. This rule specifically looks for modifications to the AppCompatFlags\Custom registry key where shims are typically registered, targeting common system processes.
This rule detects attempts to backdoor a domain object by granting DCSync rights to a regular user or machine account. This is achieved by modifying the 'ntSecurityDescriptor' attribute in Active Directory, specifically looking for GUIDs associated with DCSync extended rights. Such a modification allows the designated account to perform DCSync attacks, enabling the retrieval of password hashes for any user or computer in the domain.
This rule detects modifications to specific registry keys related to shell open commands for 'ms-settings' and 'exefile'. These modifications are commonly used for persistence and UAC bypass techniques, particularly those leveraging tools like UACMe and targeting executables such as fodhelper.exe, computerdefaults.exe, and slui.exe. The rule looks for changes to 'SymbolicLinkValue', 'DelegateExecute', and '(Default)' values within these registry paths, while filtering out empty default values.
This rule detects attempts to bypass User Account Control (UAC) by modifying the Windows Registry related to the 'mscfile' handler. Specifically, it looks for changes to the default command associated with '.msc' files, which can be abused by 'eventvwr.exe' to execute arbitrary code with elevated privileges without a UAC prompt. The filter excludes legitimate modifications where the 'Details' field starts with '%SystemRoot%\system32\mmc.exe "%1" %', aiming to reduce false positives from standard system operations.
This rule detects attempts to obfuscate the `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` registry key path by inserting various special characters between the letters. This technique is often used by malware to establish persistence and evade detection.
This rule detects the creation or modification of specific registry keys that have been observed in attacks attributed to the OceanLotus (also known as APT32) threat group. The rule specifically looks for patterns in `TargetObject` paths related to CLSID entries and `AppX` entries within `HKCU\SOFTWARE\Classes` and `HKCU\SOFTWARE\App`.
Detects the creation or modification of a custom protocol handler in the Windows Registry with the name "rogue" and a specific CLSID. This activity has been observed as a persistence mechanism used by the Forest Blizzard APT group (also known as Star Blizzard or COLDRIVER). By setting a custom protocol handler, the adversary can execute arbitrary code when a specially crafted URI is accessed.
Detects modifications to specific registry keys under 'Software\Policies\Microsoft\Windows\System\Scripts' related to system startup, shutdown, logon, and logoff scripts. These modifications can be used to establish persistence or escalate privileges by executing malicious code at various system events.
Monitors for the creation or modification of scheduled tasks in the Windows registry by processes other than common legitimate ones like svchost.exe. This can indicate an adversary establishing persistence or executing malicious code via scheduled tasks.
This rule detects attempts by non-privileged users (IntegrityLevel: Medium or S-1-16-8192) to modify Windows service configurations in the registry. It specifically looks for command-line executions of 'reg' with 'add' or 'powershell' with 'set-itemproperty', 'sp', or 'new-itemproperty' that target service-related registry paths (containing 'ControlSet' and 'Services') and modify critical service parameters like 'ImagePath', 'FailureCommand', or 'ServiceDLL'. This activity could indicate an attempt to establish persistence or elevate privileges by hijacking service execution.
This rule detects PowerShell script blocks that modify the Windows Registry keys associated with Winlogon helper DLLs. Adversaries can modify these keys to load and execute malicious DLLs or executables when a user logs on, achieving persistence and potentially privilege escalation. The rule specifically looks for the string 'CurrentVersion\Winlogon' in conjunction with PowerShell cmdlets like 'Set-ItemProperty' or 'New-Item', indicating an attempt to alter Winlogon's configuration.
Detects the creation or modification of registry keys associated with Windows Assistive Technology applications, specifically focusing on changes to the 'ATs' and 'Configuration' keys under 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility'. This activity can be indicative of persistence or privilege escalation attempts by adversaries abusing accessibility features like 'atbroker.exe'. The rule includes filters to reduce false positives from legitimate 'atbroker.exe' activity or MSI installers.
Detects modifications to specific autostart extensibility points (ASEPs) within the Windows Registry's Session Manager key. These modifications can be used by adversaries to establish persistence or elevate privileges by ensuring malicious code is executed during system boot or user logon. The rule specifically targets changes to 'SetupExecute', 'S0InitialCommand', 'KnownDlls', 'Execute', 'BootExecute', and 'AppCertDlls' values under the 'System\CurrentControlSet\Control\Session Manager' path.
Detects modifications to specific Windows Registry keys under the `Wow6432Node\Microsoft\Windows NT\CurrentVersion` path, which are commonly used for autostart extensibility points (ASEPs). Specifically, it looks for changes to `Appinit_Dlls` and `Image File Execution Options` which can be abused for persistence or privilege escalation.
This rule detects modifications to the Windows Registry keys associated with Application Shimming. Adversaries may use application shims to establish persistence and/or elevate privileges by executing malicious content. The rule specifically looks for changes within the 'InstalledSDB' and 'Custom' AppCompatFlags registry paths, which are used to store information about installed shim databases.
Detects the modification of an existing service's configuration (binpath or failure command) using 'sc.exe' or 'reg.exe' to execute an arbitrary payload. This is a common method for establishing persistence or escalating privileges by ensuring a malicious executable runs when the service starts or fails.
This rule detects the use of the 'reg.exe' command-line tool to add entries to specific Windows Registry Run keys. These Run keys are commonly used by adversaries to establish persistence, ensuring that a malicious program executes automatically when a user logs in. The rule specifically looks for 'reg.exe' being executed with 'add' command and targeting 'Software\Microsoft\Windows\CurrentVersion\Run', 'Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run', or 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run' registry paths.
Detects the execution of 'regini.exe', a legitimate Windows utility that can be used to modify registry keys by importing changes from one or more text files. This activity can be indicative of an adversary attempting to alter system configurations, achieve persistence, or evade defenses by manipulating the Windows Registry.
Page 14 of 22