Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
442 detections
Filters
Last updated
All Time
Detection languages
177
95
67
56
11
Contributors
86
58
55
51
21
Categories
20,424
11,812
5,870
5,145
4,864
Platforms
441
8
3
3
1
Products / Services
144
116
86
36
21
MITRE Techniques
343
237
197
130
121
CVEs
3
2
1
1
1
IDS Classtypes
10
IDS Protocols
10
Detects potential malicious modification of the 'Run' registry key by malware identified as 'winekey' or 'team9' (Bazar/KEGTAP) to establish persistence. Specifically, it looks for modifications to the 'Software\Microsoft\Windows\CurrentVersion\Run\Backup Mgr' registry value.
Detects modifications to Internet Explorer's autostart extensibility points (ASEPs) in the Windows Registry. Adversaries may modify these registry keys to establish persistence or elevate privileges by ensuring malicious code executes when Internet Explorer starts or when a user logs in.
Detects modifications to autostart extensibility points (ASEP) within the Windows Registry, specifically focusing on keys under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion' that are commonly used for persistence. This includes modifications to Winlogon, Windows, Image File Execution Options, Font Drivers, and Drivers32 subkeys. The rule includes filters for known legitimate activities by Microsoft Edge, Microsoft Office, OneDrive, Avira, and .NET Framework's NGEN.
This rule detects modifications to specific autostart extensibility points (ASEPs) within the `Wow6432Node` path of the Windows registry. These registry keys are commonly used by legitimate applications for persistence, but also by adversaries to establish persistence or elevate privileges by ensuring their malicious code executes upon user login or system startup. The rule specifically targets modifications under `HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion` for keys like `Run`, `RunOnce`, `ShellServiceObjectDelayLoad`, and various `Explorer` related autostart locations.
This rule detects the creation or modification of the 'MiniNt' registry key under 'HKLM\SYSTEM\CurrentControlSet\Control\'. The presence of this key, particularly after a system reboot, can prevent the Windows Event Log service from writing events, effectively disabling security event logging. This is a known technique used by adversaries for defense evasion.
Detects the creation or modification of Windows Run keys by executables located in suspicious directories such as user Downloads, temporary Outlook attachments, or Internet Explorer temporary files. This behavior is often indicative of persistence mechanisms used by malware or adversaries.
Detects modifications to common autostart extensibility points (ASEP) in the Windows Registry. These registry keys are frequently used by legitimate software and adversaries to establish persistence by ensuring programs execute automatically upon system boot or user logon. The rule specifically targets a wide range of registry paths associated with autorun functionality, including those for Command Processor, Active Setup, Internet Explorer, and various system services. It includes filters to reduce false positives from known legitimate Microsoft Office, Chrome, Edge, and Internet Explorer activities.
Detects modifications to specific registry keys under the 'Classes' hive that are commonly used as autostart extensibility points (ASEPs). These modifications can be used by adversaries to establish persistence or elevate privileges by ensuring their code executes automatically.
Detects modifications to the WinSock2 Parameters registry keys, specifically within Protocol_Catalog9 and NameSpace_Catalog5 entries. These modifications can be used for persistence by adversaries to load malicious code or redirect network traffic.
Detects the use of 'regini.exe' to modify registry keys by importing an alternate data stream. This technique can be used for persistence, defense evasion, or other malicious activities by adversaries.
Detects changes to the PSFactory COM InProcServer32 registry key, specifically targeting the CLSID {c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}. This technique has been observed being used by the RomCom threat actor to establish persistence by storing a malicious DLL, replacing the legitimate ActXPrxy.dll.
Detects registry persistence attempts via Run and RunOnce keys in both user and machine hives, focusing on value names and data referencing known Subtle Snail malicious files and suspicious payload names. Tracks registry modifications indicating adversary attempts to maintain persistent execution through stealthy implant DLLs and executables.
This rule identifies when a USB removable media device is attached to a Windows host by monitoring modifications to the HKLM\System\CurrentControlSet\Enum\USBSTOR\ registry key. Adversaries and insider threats may use removable media devices for various malicious activities, including initial access, execution, and data exfiltration.
This analytic is used to identify when a USB removable media device is attached to a Windows host. It queries the Endpoint Registry data model to look for modifications to the Windows Portable Device keys HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
The following analytic identifies modifications to registry keys commonly used for persistence mechanisms. It leverages data from endpoint detection sources like Sysmon or Carbon Black, focusing on specific registry paths known to initiate applications or services during system startup. This activity is significant as unauthorized changes to these keys can indicate attempts to maintain persistence or execute malicious actions upon system boot. If confirmed malicious, this could allow attackers to achieve persistent access, execute arbitrary code, or maintain control over compromised systems, posing a severe threat to system integrity and security.
The following analytic detects attempts to change the default file association for files without an extension to open with Notepad.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns and registry modifications. This activity is significant as it can indicate an attempt to manipulate file handling behavior, a technique observed in APT and ransomware attacks like Prestige. If confirmed malicious, this could allow attackers to execute arbitrary code by tricking users into opening files, potentially leading to system compromise or data exfiltration.
The following analytic detects attempts to change the command value of a file association of an extension to open with Notepad.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns and registry modifications. This activity is significant as it can indicate an attempt to manipulate file handling behavior, a technique observed in APT and ransomware attacks like Prestige. After changing the extension of all encrypted files to a new one, Prestige ransomware modifies the file association for that extension to open with Notepad.exe in order to display a ransom note.
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
Detects potential persistence established through the modification of registry keys related to Visual Studio Tools for Office (VSTO) add-ins for Microsoft Office applications like Outlook, Word, Excel, and PowerPoint. Adversaries can leverage VSTO add-ins to execute malicious code when an Office application starts, thereby maintaining persistence on a compromised system. The rule specifically looks for changes to the 'Addins' registry paths for various Office applications and the VSTO Security Inclusion path, while filtering out common legitimate processes that might make such changes.
Detects registry modifications associated with the Gentlemen ransomware group. These changes are intended to weaken security controls for NTLM, Remote Desktop Protocol (RDP), and administrative access to facilitate lateral movement and persistence.
Detects the modification of the 'UserInitMprLogonScript' registry key to execute a PowerShell script with a hidden window. This persistence technique was used by the COLDRIVER APT group.
Page 15 of 22