Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
442 detections
Filters
Last updated
All Time
Detection languages
177
95
67
56
11
Contributors
86
58
55
51
21
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
441
8
3
3
1
Products / Services
144
116
86
36
21
MITRE Techniques
343
237
197
130
121
CVEs
3
2
1
1
1
IDS Classtypes
10
IDS Protocols
10
Looks for suspicious base64 encoded registry keys being created.
Author: Jouni Mikkola
References:
https://threathunt.blog/registry-hunts/
Author: Jouni Mikkola
References:
https://threathunt.blog/registry-hunts/
'Identifies attempts to modify registry ACL to evade security solutions. In the Solorigate attack, the attackers were found modifying registry permissions so services.exe cannot access the relevant registry keys to start the service.
The detection leverages Security Event as well as MDE data to identify when specific security services registry permissions are modified.
Only some portions of this detection are related to Solorigate, it also includes coverage for some common tools that perform this activity.
Reference on guidance for enabling registry auditing:
- https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-auditing-faq
- https://docs.microsoft.com/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events
- https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-registry
- https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4670
- For the event 4670 to be created the audit policy for the registry must have auditing enabled for Write DAC and/or Write Owner
- https://github.com/OTRF/Set-AuditRule
- https://docs.microsoft.com/dotnet/api/system.security.accesscontrol.registryrights?view=dotnet-plat-ext-5.0'
The detection leverages Security Event as well as MDE data to identify when specific security services registry permissions are modified.
Only some portions of this detection are related to Solorigate, it also includes coverage for some common tools that perform this activity.
Reference on guidance for enabling registry auditing:
- https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-auditing-faq
- https://docs.microsoft.com/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events
- https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-registry
- https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4670
- For the event 4670 to be created the audit policy for the registry must have auditing enabled for Write DAC and/or Write Owner
- https://github.com/OTRF/Set-AuditRule
- https://docs.microsoft.com/dotnet/api/system.security.accesscontrol.registryrights?view=dotnet-plat-ext-5.0'
This analytic detects suspicious modifications or new entries in the Print Processor registry path. This activity is significant because the Print Processor registry is known to be exploited by APT groups like Turla for persistence and privilege escalation. If confirmed malicious, this could allow an attacker to execute a malicious DLL payload by restarting the spoolsv.exe process, leading to potential control over the compromised machine.
'This query detects an abuse of the DSRM account in order to maintain persistence and access to the organization's Active Directory.
Ref: https://adsecurity.org/?p=1785'
Ref: https://adsecurity.org/?p=1785'
'This query identifies Active Directory computer objects modifications that allow an adversary to abuse the Resource-based constrained delegation.
This query checks for event id 5136 that the Object Class field is "computer" and the LDAP Display Name is "msDS-AllowedToActOnBehalfOfOtherIdentity" which is an indicator of Resource-based constrained delegation.
Ref: https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html'
This query checks for event id 5136 that the Object Class field is "computer" and the LDAP Display Name is "msDS-AllowedToActOnBehalfOfOtherIdentity" which is an indicator of Resource-based constrained delegation.
Ref: https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html'
Looks for suspicious addition of command interpreters to windows registry.
Author: Jouni Mikkola
References:
https://threathunt.blog/registry-hunts/
Author: Jouni Mikkola
References:
https://threathunt.blog/registry-hunts/
Prior to deploying Macaw ransomware in an organization, the adversary will disable several tools and functions in order to inhibit later recovery efforts.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_oceanlotus_registry.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
This query was originally published in the threat analytics report, RDP ransomware persists as Wadhrama.
The ransomware known as Wadhrama has been used in human-operated attacks that follow a particular pattern. The attackers often use Remote Desktop Protocol (RDP) to gain initial access to a device or network, exfiltrate credentials, and maintain persistance.
The following query checks for possible Wadhrama-related activity, by detecting the technique these attackers have used in the past to dump credentials.
Other techniques used by the group associated with Wadhrama are listed under See also.
Reference - https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Wadhrama
The ransomware known as Wadhrama has been used in human-operated attacks that follow a particular pattern. The attackers often use Remote Desktop Protocol (RDP) to gain initial access to a device or network, exfiltrate credentials, and maintain persistance.
The following query checks for possible Wadhrama-related activity, by detecting the technique these attackers have used in the past to dump credentials.
Other techniques used by the group associated with Wadhrama are listed under See also.
Reference - https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Wadhrama
'This query looks for changes to COM registry keys to point to files in C:\Windows\System32\spool\drivers\color\.
This can be used to enable COM hijacking for persistence.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
This can be used to enable COM hijacking for persistence.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
This query identifies attempts to stop System Restore and prevent the system from creating restore points, which can be used to recover data encrypted by ransomware
This rule detects when Shadow Copies are being deleted. This is a know actions that is performed by TA.
This query detects know commands that have been used by the ransomware actors.
Some information from Mitre Attack:
https://attack.mitre.org/techniques/T1490/
This query detects know commands that have been used by the ransomware actors.
Some information from Mitre Attack:
https://attack.mitre.org/techniques/T1490/
Detects the execution of `reg.exe` to modify registry keys associated with Remote Desktop Protocol (RDP) settings. This includes attempts to enable/disable RDP or alter its behavior by tampering with values under `CurrentControlSet\Control\Terminal Server`, such as those related to concurrent sessions, RDP-TCP configurations, and other connection parameters. This activity can indicate an adversary attempting to establish persistence, facilitate lateral movement, or otherwise manipulate RDP access.
This rule detects modifications to the Windows Registry related to the SilentProcessExit mechanism for the lsass.exe process. Specifically, it looks for changes in the registry key path 'microsoft\windows nt\currentversion\silentprocessexit\lsass.exe'. This technique can be abused by adversaries to configure a monitor program to dump the memory of the lsass.exe process, which often contains sensitive credential information.
This rule detects the use of the `netsh interface portproxy` command to enable port forwarding, specifically looking for `v4tov4` configurations. It also identifies the creation or modification of associated registry settings under `HKLM\System\CurrentControlSet\Services\PortProxy\v4tov4`, which are indicative of port proxying being configured on a Windows system.
Detects suspicious command execution patterns in the RunMRU registry key often associated with Lumma Stealer ClickFix delivery using specific executables and unusual character sets.
Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process
Detects port forwarding being enabled using netsh command and registry settings created or modified in support of portproxy v4tov4
This rule detects suspicious PowerShell invocations characterized by specific command parameters often used in malicious activities. It looks for combinations of parameters like '-nop', '-w hidden', '-c', and '[Convert]::FromBase64String' for base64 encoded commands; '-w hidden', '-noni', '-nop', '-c', 'iex', and 'New-Object' for obfuscated execution; '-w hidden', '-ep bypass', and '-Enc' for encoded command execution; PowerShell commands interacting with 'reg add' to modify 'Run' keys for persistence; and PowerShell using 'New-Object System.Net.WebClient' with '.Download' for downloading content from the internet, often with 'bypass' and 'hidden' window styles. These patterns are commonly associated with malware, post-exploitation frameworks, and adversary tradecraft.
The analytic detects modifications to Windows Defender exclusion registry entries. It leverages endpoint registry data to identify changes in the registry path "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\". This activity is significant because adversaries often modify these entries to bypass Windows Defender, allowing malicious code to execute without detection. If confirmed malicious, this behavior could enable attackers to evade antivirus defenses, maintain persistence, and execute further malicious activities undetected.
The following analytic detects the modification of registry keys related to the desktop wallpaper settings. It leverages Sysmon EventCode 13 to identify changes to the "Control Panel\\Desktop\\Wallpaper" and "Control Panel\\Desktop\\WallpaperStyle" registry keys, especially when the modifying process is not explorer.exe or involves suspicious file paths like temp or public directories. This activity is significant as it can indicate ransomware behavior, such as the REVIL ransomware, which changes the wallpaper to display a ransom note. If confirmed malicious, this could signify a compromised machine and the presence of ransomware, leading to potential data encryption and extortion.
Page 18 of 22