Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
442 detections
Filters
Last updated
All Time
Detection languages
177
95
67
56
11
Contributors
86
58
55
51
21
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
441
8
3
3
1
Products / Services
144
116
86
36
21
MITRE Techniques
343
237
197
130
121
CVEs
3
2
1
1
1
IDS Classtypes
10
IDS Protocols
10
The following analytic detects a suspicious modification of the registry aimed at bypassing User Account Control (UAC) by leveraging WSReset.exe. It identifies the creation or modification of specific registry values under the path "*\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command*". This detection uses data from Endpoint Detection and Response (EDR) agents, focusing on process and registry events. This activity is significant because UAC bypass techniques can allow attackers to execute high-privilege actions without user consent. If confirmed malicious, this could lead to unauthorized code execution and potential system compromise.
The following analytic detects a process modifying the registry with a known malicious CLSID under InProcServer32. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry modifications within the HKLM or HKCU Software Classes CLSID paths. This activity is significant as it may indicate an attempt to load a malicious DLL, potentially leading to code execution. If confirmed malicious, this could allow an attacker to persist in the environment, execute arbitrary code, or escalate privileges, posing a severe threat to system integrity and security.
The analytic identifies suspicious modifications in the registry entry, specifically targeting paths used by malware like REVIL. It detects changes in registry paths such as `SOFTWARE\WOW6432Node\Facebook_Assistant` and `SOFTWARE\WOW6432Node\BlackLivesMatter`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry modifications linked to process GUIDs. This activity is significant as it indicates potential malware persistence mechanisms, often used by advanced persistent threats (APTs) and ransomware. If confirmed malicious, this could allow attackers to maintain persistence, encrypt files, and store critical ransomware-related information on compromised hosts.
The following analytic detects modifications to the Windows registry that disable Windows Defender Signature Retirement. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the DisableSignatureRetirement registry setting. This activity is significant because disabling signature retirement can prevent Windows Defender from removing outdated antivirus signatures, potentially reducing its effectiveness in detecting threats. If confirmed malicious, this action could allow an attacker to evade detection by using older, less relevant signatures, thereby compromising the system's security posture.
The following analytic detects modifications to the registry aimed at bypassing the User Account Control (UAC) feature in Windows. It identifies changes to the .NET COR_PROFILER_PATH registry key, which can be exploited to load a malicious DLL via mmc.exe. This detection leverages data from the Endpoint.Registry datamodel, focusing on specific registry paths and values. Monitoring this activity is crucial as it can indicate an attempt to escalate privileges or persist within the environment. If confirmed malicious, this could allow an attacker to execute arbitrary code with elevated privileges, compromising system integrity.
This analytic detects attempts to modify or add a Component Object Model (COM) entry to the InProcServer32 path within the registry using PowerShell. It leverages PowerShell ScriptBlock Logging (EventCode 4104) to identify suspicious script blocks that target the InProcServer32 registry path. This activity is significant because modifying COM objects can be used for persistence or privilege escalation by attackers. If confirmed malicious, this could allow an attacker to execute arbitrary code or maintain persistent access to the compromised system, posing a severe security risk.
This rule detects attempts to escalate privileges by modifying Windows service configurations using 'sc.exe' from a non-administrative context (Medium integrity level). Specifically, it looks for modifications to a service's 'binPath' (ImagePath) or 'FailureCommand', which could allow an attacker to execute arbitrary code with elevated privileges when the service starts or fails.
Detects the modification of the PortProxy registry key, which is used for port forwarding. This can indicate an adversary setting up a proxy for lateral movement or command and control.
This rule detects suspicious behaviors associated with the SOURGUM actor, as tracked by Microsoft. Specifically, it looks for the creation of processes with specific image paths related to 'Physmem.sys' or 'WimBootConfigurations.ini' within IME directories. Additionally, it identifies attempts to modify registry keys associated with Component Object Model (COM) objects, specifically InprocServer32 entries for CLSIDs {7c857801-7381-11cf-884d-00aa004b2e24} and {cf4cc405-e2c5-4ddd-b3ce-5e7582d8c9fa}, using the 'reg add' command.
Detects modifications to Group Policy settings using `reg.exe` by looking for specific registry paths and keys commonly associated with Group Policy configurations. Malicious GPO modifications can be used to implement various other malicious behaviors, including privilege escalation and defense evasion.
Detects the modification of the 'Debugger' value within the Image File Execution Options (IFEO) registry key for various Windows accessibility tools. This technique is commonly used by adversaries to establish persistence and privilege escalation by replacing legitimate accessibility tools (like sethc.exe or utilman.exe) with a malicious executable that launches with SYSTEM privileges from the login screen.
Detects attempts to modify the Discretionary Access Control List (DACL) of Active Directory objects, specifically looking for WRITE_DAC access (0x40000). This can indicate an adversary attempting to gain control over Active Directory objects, potentially for privilege escalation or persistence.
Detects modifications or additions to the 'TypedPaths' registry key via the command line, which can indicate an attempt to establish persistence. The 'TypedPaths' key stores recently typed paths in Windows Explorer, and adversaries might manipulate it to execute malicious code when a user accesses certain paths.
This rule detects the use of the `sc.exe` utility to modify the security descriptor of a Windows service. Specifically, it looks for the `sdset` command-line argument, which can be used to grant special permissions to a service, potentially allowing it to be hidden or manipulated for persistence and defense evasion. This technique can be used by adversaries to maintain access and avoid detection by making services less visible to standard enumeration tools.
This rule detects suspicious modifications to the Windows Registry related to the 'ms-settings' URI scheme, specifically targeting the 'DelegateExecute' value or the default value of 'HKCU\Software\Classes\ms-settings\Shell\Open\Command'. This technique can be used by adversaries to hijack the execution of applications launched via the 'ms-settings' URI, potentially leading to arbitrary code execution or privilege escalation. The rule also includes a detection for the deletion of the 'ms-settings' key, which could be an attempt to clean up after such an attack.
This rule detects attempts to establish persistence and evade defenses by registering a new Subject Interface Package (SIP) provider. Attackers can modify specific registry keys related to cryptographic providers to redirect signature validation functions to malicious DLLs. This allows them to bypass application control mechanisms by making the system trust unsigned or malicious code as legitimately signed. The rule specifically looks for modifications to registry paths associated with Microsoft Cryptography Providers and OID EncodingType, where the 'Dll' or '$DLL' values are being set, while filtering out known legitimate SIP registrations by the OS or specific software like WINTRUST.DLL and mso.dll. It also filters out specific legitimate activity related to poqexec.exe and PsfSip.dll.
This rule detects User Account Control (UAC) bypass attempts by monitoring specific registry key modifications related to `sdclt.exe`. Attackers can manipulate these registry keys to hijack the execution flow of `sdclt.exe`, a legitimate Windows utility, to run arbitrary code with elevated privileges without triggering a UAC prompt. The rule specifically looks for modifications to `Software\Classes\exefile\shell\runas\command\isolatedCommand` or `Software\Classes\Folder\shell\open\command\SymbolicLinkValue` with a specific pattern indicating a UAC bypass technique.
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe". This technique is often used to bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.
Detects the creation or modification of a specific registry key path associated with the 'Pandemic' Windows implant. The key path observed is '\SYSTEM\CurrentControlSet\services\null\Instance'. This rule helps identify the presence or activity of the Pandemic malware.
Detects handle requests and access operations to specific registry keys to calculate the SysKey
This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent.
This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent.
This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent.
Page 21 of 22