Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
442 detections
Filters
Last updated
All Time
Detection languages
177
95
67
56
11
Contributors
86
58
55
51
21
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
441
8
3
3
1
Products / Services
144
116
86
36
21
MITRE Techniques
343
237
197
130
121
CVEs
3
2
1
1
1
IDS Classtypes
10
IDS Protocols
10
This rule detects modifications to Windows 'Run' registry keys, specifically monitoring for the creation or value setting of keys associated with known suspicious or persistence-related names such as 'SMQDService' or 'winappx'. These registry keys are frequently used by attackers to maintain persistence by ensuring malicious code executes automatically upon user login.
This rule detects modifications to Windows 'Run' registry keys, specifically monitoring for the creation or value setting of keys associated with known suspicious or persistence-related names such as 'SMQDService' or 'winappx'. These registry keys are frequently used by attackers to maintain persistence by ensuring malicious code executes automatically upon user login.
This rule detects modifications to Windows 'Run' registry keys, specifically monitoring for the creation or value setting of keys associated with known suspicious or persistence-related names such as 'SMQDService' or 'winappx'. These registry keys are frequently used by attackers to maintain persistence by ensuring malicious code executes automatically upon user login.
Detects a suspicious sequence of activity involving persistence via Registry Run keys (specifically targeting SMQDService or winappx entries) followed by modifications to Microsoft Defender configuration (adding exclusions via PowerShell) within a two-hour window on the same device.
This rule detects modifications to the Windows 'Run' registry key intended to achieve persistence by launching potentially malicious executables named 'RuntimeSSH.exe' or 'winappx.exe'. Attackers often use these paths to ensure that their malicious code executes automatically upon user login.
Detects modifications to the 'HKCU\Software\Classes\ms-settings\shell\open\command' registry key, a technique used to hijack the fodhelper.exe binary to achieve silent UAC elevation. This allows attackers to execute commands with administrative privileges without triggering a UAC prompt.
Detects the creation of a Windows service named 'WpnUserHost' or the modification of its registry configuration where the binary path does not reside within the System32 directory. This behavior is indicative of a potential attempt to masquerade a malicious service or achieve persistence using a legitimate-sounding service name.
Detects the creation or modification of Windows Registry run keys (Run or RunOnce) that attempt to point to executables within 'ProgramData\Synaptics' or named 'synaptics.exe'. This behavior is characteristic of adversaries attempting to establish persistence by masquerading as legitimate Synaptics driver software, while excluding legitimate installation directories.
Detects suspicious service creation or registry modifications involving WpnUserHost that do not reference System32.
Detects the creation of a Windows service named 'WpnUserHost' or the modification of its registry configuration where the binary path does not reside within the System32 directory. This behavior is indicative of a potential attempt to masquerade a malicious service or achieve persistence using a legitimate-sounding service name.
Detects suspicious service creation or registry modifications involving WpnUserHost that do not reference System32.
Detects suspicious service creation or registry modifications involving WpnUserHost that do not reference System32.
Detects the creation of a Windows service named 'WpnUserHost' or the modification of its registry configuration where the binary path does not reside within the System32 directory. This behavior is indicative of a potential attempt to masquerade a malicious service or achieve persistence using a legitimate-sounding service name.
Detects the creation of a Windows service named 'WpnUserHost' or the modification of its registry configuration where the binary path does not reside within the System32 directory. This behavior is indicative of a potential attempt to masquerade a malicious service or achieve persistence using a legitimate-sounding service name.
Detects the creation of a Windows service named 'WpnUserHost' or the modification of its registry configuration where the binary path does not reside within the System32 directory. This behavior is indicative of a potential attempt to masquerade a malicious service or achieve persistence using a legitimate-sounding service name.
Detects modifications to Windows Defender registry keys responsible for exclusions. Specifically monitors when paths or processes associated with potentially suspicious locations (like C:\Drivers) or common system binaries (VSSVC.exe, ctfmon.exe, C:\Windows\System32) are added to the Defender exclusion list. This is a common technique used by attackers to hide malicious files or activity from antivirus scanning.
Detects when bcdedit or bootcfg is executed and Safeboot registry keys modified within a specified time window
Detects activity (opens, reads, or writes) involving the Windows Registry key associated with Chrome's App Paths. Modifying this key is a common method for achieving persistence or hijacking the execution path of the Chrome browser.
Detects signs of Cloudflared tunnel persistence on Windows endpoints, specifically targeting service registration (via sc.exe or registry modifications) and the presence of the cloudflared.exe binary. This is often used by attackers to maintain outbound-only access to compromised machines following exploitation of vulnerabilities like CVE-2026-18577.
Detects the mounting of a registry hive into an HKEY_USERS Classes root where the SID embedded in the registry key path does not match the SID of the process account that initiated the operation. This behavior is associated with the 'LegacyHive' exploitation technique, where an attacker attempts to mount another user's (or administrator's) registry hive into their own context to facilitate privilege escalation.
Detects a registry hijack of the 'ms-settings\Shell\Open\command' key, followed by the execution of auto-elevated binaries 'fodhelper.exe' or 'computerdefaults.exe'. The rule identifies potential UAC bypass attempts by correlating these registry modifications with the subsequent spawning of an unsigned or unrecognized child process by the auto-elevated binary.
Page 4 of 22