Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
442 detections
Filters
Last updated
All Time
Detection languages
177
95
67
56
11
Contributors
86
58
55
51
21
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
441
8
3
3
1
Products / Services
144
116
86
36
21
MITRE Techniques
343
237
197
130
121
CVEs
3
2
1
1
1
IDS Classtypes
10
IDS Protocols
10
Detects the YiBackdoor persistence technique where a DLL is written to disk and subsequently configured to be executed by regsvr32.exe via a registry Run key.
The ZoneMap key under Internet Settings is used to define security zones for specific domains. By setting a value under ZoneMap\Domains, you are configuring how Windows handles security and permissions for that domain so it is really helpful to identify if some site has been added via cli manually or by some malicious script to whitelist some domains and bypass some defense.
Detects persistence mechanisms associated with a Winos malware variant. This includes the creation of the 'Software\DeepSer' registry key or the modification of the 'User Shell Folders\Startup' key to redirect to a malicious folder.
The analytic detects the modification of the Windows Registry key "LoadMacroProviderOnBoot" under Outlook. This enables automatic loading of macros, which could allow malicious scripts to run without notice. This detection leverages data from the Endpoint.Registry datamodel to search for this key being enabled. This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
This detection identifies the installation of known malicious Chrome extensions associated with the "Madgicx Plus" campaign, which targets Meta advertisers to steal credentials and hijack sessions. The rule looks for registry modifications that include the specific IDs of these malicious extensions.
The analytic detects the modification of the Windows Registry key "PONT_STRING" under Outlook Options. This disables certain dialog popups, which could allow malicious scripts to run without notice. This detection leverages data from the Endpoint.Registry datamodel to search for this key changing from an unusual process. This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
KQL Query
Detects TTPs associated with a Lazarus subgroup using the SessionEnv service for persistence and privilege escalation. This involves phantom DLL loading, service auto-start configuration, and registry modification for elevated privileges.
This detection identifies attempts to disable Microsoft Defender Antivirus or bypass its protection mechanisms such as Tamper Protection or Real-Time Protection.
It leverages signals from Microsoft Defender for Endpoint (via DeviceEvents) as well as Windows Security Events (e.g., Event ID 5001 and 5004), which are triggered when antivirus services are modified or stopped.
Such behavior is commonly associated with defense evasion techniques used by threat actors or unauthorized administrative actions and should be investigated immediately.
It leverages signals from Microsoft Defender for Endpoint (via DeviceEvents) as well as Windows Security Events (e.g., Event ID 5001 and 5004), which are triggered when antivirus services are modified or stopped.
Such behavior is commonly associated with defense evasion techniques used by threat actors or unauthorized administrative actions and should be investigated immediately.
This detection identifies suspicious DLL loads by SpeechRuntime.exe from outside the expected system directories. SpeechRuntime is vulnerable to a COM hijacking attack that allows an attacker to execute code remotely and stealthily by exploiting a Windows COM class. By altering the registry to point to a malicious DLL and then triggering the COM object, the attacker can cause the malicious DLL to load into SpeechRuntime.exe and execute in the user's context.
Detects a Component Object Model (COM) TypeLib hijacking persistence technique. This rule identifies modifications to the registry for the 'Microsoft Web Browser' CLSID, where it is altered to point to a malicious scriptlet (.sct) file. This specific method was used by the MixShell malware in the ZipLine campaign to maintain access.
The analytic identifies the deletion or modification of registry keys that disable Local Security Authority (LSA) protection and Microsoft Defender Device Guard. This activity is significant because disabling these defenses can leave a system vulnerable to various attacks, including credential theft and unauthorized code execution. If confirmed malicious, this action could allow attackers to bypass critical security mechanisms, leading to potential system compromise and persistent access.
Detects Component Object Model (COM) hijacking used by the Curly COMrades threat actor for persistence. This rule identifies registry modifications that alter specific CLSIDs related to the .NET NGEN task to load the MucorAgent malware.
This rule detects activities associated with the RomCom threat group, including exploitation of CVE-2025-8088 (WinRAR path traversal), COM hijacking for persistence, anti-analysis techniques (RecentDocs check), C2 communication, and suspicious WMIC execution, potentially linked to a Mythic agent.
Detects the simultaneous modification of 'msDS-ManagedAccountPrecededByLink' and 'msDS-DelegatedMSAState' attributes on a delegated Managed Service Account (dMSA) object. This activity is a strong indicator of the BadSuccessor privilege escalation technique, where an attacker simulates a dMSA migration to impersonate a target account.
Detects anomalous system behavior that could indicate sophisticated threats deviating from normal activity. This includes unusual process-parent relationships, unexpected network connections from scripting engines, and attempts to modify registry keys related to AMSI or ETW configuration.
This query detects multiple behaviors associated with the ApolloShadow malware, used by the Secret Blizzard threat actor. It looks for the creation of a specific administrator account, installation of root certificates using certutil, modification of Firefox settings to trust new certificates, and changes to network profiles to relax firewall rules.
This analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. The detection specifically looks for modifications to the 'Run' registry keys or 'ImagePath' values within service registry keys, which are common methods for establishing persistence. The rule leverages a lookup table containing known remote access tools such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
The following analytic detects the creation of registry artifacts when an ISO container is opened, clicked, or mounted on a Windows operating system. It leverages data from the Endpoint.Registry data model, specifically monitoring registry keys related to recent ISO or IMG file executions. This activity is significant as adversaries increasingly use container-based phishing campaigns to bypass macro-based document execution controls. If confirmed malicious, this behavior could indicate an initial access attempt, potentially leading to further exploitation, persistence, or data exfiltration within the environment.
This analytic detects the presence of a registry key associated with the Remcos RAT agent on a host. It leverages data from the Endpoint.Registry data model, focusing on instances where the "Software\Remcos" path is found. This behavior indicates potential compromise by the Remcos RAT, a remote access Trojan used for unauthorized access and data exfiltration. If confirmed malicious, the attacker could gain control over the system, steal sensitive information, or use the compromised host for further attacks. Immediate investigation and remediation are required.
This rule detects attempts to flush Shimcache using rundll32.exe, which can indicate anti-forensic activity or defense evasion by an attacker. The detection logic specifically looks for command-line arguments associated with flushing the Shimcache, including function names like "ShimFlushCache" or "BaseFlushAppcompatCache", and also checks for ordinal values combined with specific DLLs like "apphelp.dll" or "kernel32.dll".
Page 16 of 22