Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
442 detections
Filters
Last updated
All Time
Detection languages
177
95
67
56
11
Contributors
86
58
55
51
21
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
441
8
3
3
1
Products / Services
144
116
86
36
21
MITRE Techniques
343
237
197
130
121
CVEs
3
2
1
1
1
IDS Classtypes
10
IDS Protocols
10
This rule detects modifications to Windows Defender exclusion paths in the registry. Adversaries may modify these registry keys to add exclusions for their malicious files or processes, allowing them to evade detection by Windows Defender. The rule specifically looks for changes to the 'Exclusions\Paths', 'Exclusions\Processes', and 'Exclusions\Extensions' keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender.
KQL Query from file: Potential ClickFix Execution
Detects suspicious registry modifications for IFEO entries which can be used by attackers for persistence.
This is based off of testing with Atomic Red Team tests - https://www.atomicredteam.io/atomic-red-team/atomics/T1546.012
This is based off of testing with Atomic Red Team tests - https://www.atomicredteam.io/atomic-red-team/atomics/T1546.012
This detection identifies attempts to establish persistence by modifying known Windows startup registry keys. These keys control which programs are automatically executed during system boot or user logon and are frequently abused by adversaries to maintain access across reboots.
Analysts will need to tune the rule through testing and using the exclusion statements to remove noise of what is known good within their environments.
Analysts will need to tune the rule through testing and using the exclusion statements to remove noise of what is known good within their environments.
This KQL detection is designed for use in Microsoft Defender for Endpoint Advanced Hunting or Microsoft Sentinel, depending on table availability.
It focuses on identifying two common persistence techniques used by threat actors:
COM hijacking via user-specific registry hives (InprocServer32 and LocalServer32), particularly when leveraged by .NET or PowerShell-based malware; and uncommon registry-based persistence through suspicious keys such as DelegateExecute, TreatAs, and ScriptletURL.
The KQL focusses on user-specific registry hives as they don't require elevated privileges to modify and is why we also ignore "nt authority" activity as this detection is focused on low hanging fruit that would be easily accessible to a threat actor initially for persistence without privilege escalation.
It focuses on identifying two common persistence techniques used by threat actors:
COM hijacking via user-specific registry hives (InprocServer32 and LocalServer32), particularly when leveraged by .NET or PowerShell-based malware; and uncommon registry-based persistence through suspicious keys such as DelegateExecute, TreatAs, and ScriptletURL.
The KQL focusses on user-specific registry hives as they don't require elevated privileges to modify and is why we also ignore "nt authority" activity as this detection is focused on low hanging fruit that would be easily accessible to a threat actor initially for persistence without privilege escalation.
KQL Query
KQL Query
KQL Query from file: Detecting Windows Side-Loading DLL attacks
KQL Query from file: Detect & mitigate potential Specula Exploitation
KQL Query from file: RID Hijacking Technique and Detection
This rule detects changes to the Windows Registry key that controls the Remote Desktop Protocol (RDP) port number. Specifically, it triggers when the RDP port is modified from its default value of 3389 to any other port. This activity can be indicative of an adversary attempting to evade detection, bypass network filtering, or maintain persistence by configuring RDP to listen on a non-standard port.
Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections'...etc
Detects modifications to specific registry keys under `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control` that are commonly used for autostart extensibility points (ASEPs). This includes keys related to Terminal Services, Security Providers, Safe Boot, Print Monitors/Providers, Network Provider Order, and LSA Authentication/Notification Packages. Such modifications can be indicative of persistence mechanisms used by adversaries.
Detects tampering of RDP Terminal Service/Server sensitive settings by monitoring modifications to specific registry keys. This includes changes that could allow unauthorized users access via 'fAllowUnsolicited', or enabling RDP via 'fDenyTSConnections' by setting their values to 'DWORD (0x00000000)'.
Detects modifications to various Windows Registry keys under `CurrentVersion` that are commonly used for autostart extensibility points (ASEPs). This includes `Run`, `RunOnce`, `RunOnceEx`, `RunServices`, `RunServicesOnce`, `ShellServiceObjectDelayLoad`, `Policies\System\Shell`, `Policies\Explorer\Run`, `Group Policy\Scripts`, `Explorer\ShellServiceObjects`, `Explorer\ShellIconOverlayIdentifiers`, `Explorer\ShellExecuteHooks`, `Explorer\SharedTaskScheduler`, `Explorer\Browser Helper Objects`, `Authentication\PLAP Providers`, `Authentication\Credential Providers`, and `Authentication\Credential Provider Filters`. Adversaries often modify these keys to establish persistence on a system by ensuring their malicious code executes automatically during system boot or user logon.
Detects modifications to the 'User Shell Folders' registry key, specifically the 'Startup' value. This technique is often used by adversaries to establish persistence by ensuring a malicious payload is launched automatically when a user logs in.
Detects modifications to specific Windows Registry keys that disable or modify features of internal Windows tools. These modifications are often used by malware to hinder system functionality or security mechanisms. The rule looks for changes to registry keys related to disabling the command prompt, control panel, run dialog, log off, password changes, workstation locking, registry tools, task manager, display settings, notification center, UAC consent prompt behavior, inactivity timeout, shutdown without logon, push notifications, and write protection for storage devices. The rule specifically looks for these registry keys being set to a DWORD value of '0x00000001' (to disable features) or '0x00000000' (to enable or modify behavior of certain features like UAC consent prompt, inactivity timeout, shutdown without logon, push notifications, and write protection).
This rule detects the creation or modification of Windows Registry Run keys that point to executable files located in suspicious folders. Adversaries often use Run keys for persistence, ensuring their malicious code executes automatically when a user logs in. The rule specifically looks for entries in common Run key paths (e.g., CurrentVersion\Run, Wow6432Node\Microsoft\Windows\CurrentVersion\Run, Policies\Explorer\Run) where the associated executable's path is within directories commonly used by malware or temporary files (e.g., PerfLogs, ProgramData, Windows\Temp, AppData\Local\Temp, Recycle.Bin, Users\Default, Users\Public, or user profile subdirectories like Favorites, Music, Documents). A specific exclusion is included for legitimate Windows update processes that might write to temporary folders via RunOnce keys.
Detects modifications to specific registry keys under 'System\CurrentControlSet\Control\Session Manager' that are used for autostart extensibility points (ASEPs). These keys include 'SetupExecute', 'S0InitialCommand', 'KnownDLLs', 'Execute', 'BootExecute', and 'AppCertDLLs'. Adversaries often modify these keys to establish persistence or elevate privileges by ensuring their malicious code runs automatically during system boot or user login.
This rule detects the use of the `reg.exe` utility to add or modify registry keys or subkeys in specific suspicious paths. These paths are often abused by adversaries for persistence, defense evasion, or to modify system behavior. The rule specifically looks for modifications to paths related to AppDataLow, Windows Policies, Winlogon, SecurityProviders (WDigest), and Windows Defender.
This rule detects attempts to establish persistence by modifying Windows Registry Run keys to execute PowerShell commands or scripts. It specifically looks for modifications to common Run key paths (CurrentVersion\Run, Wow6432Node\Microsoft\Windows\CurrentVersion\Run, Policies\Explorer\Run) that contain keywords indicative of PowerShell execution, such as 'powershell', 'pwsh', 'frombase64string', download functions, hidden window styles, no profile, encoded commands, execution policy bypass, and various Invoke- commands (Invoke-Expression, Invoke-Command, Invoke-WebRequest).
Page 17 of 22